[TheNorm]

Originally Posted by Shaun

... a breach of the DPA.

Probably not. An IP address and list of web sites visited does not constitute "personal information", as far as I can see:

Definition
Personal data are defined in the Data Protection Act, as follows:-
"data which relate to a living individual who can be identified:-
* from those data; or
* from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual".

http://www.dataprotectionact.org/2.html