Landy:
There have been huge misunderstandings about DPA (in E&W) since its inception and I spent a lot of time in my former career dealing with them.
The principle is that any organisation which holds searchable identifiable personal data (electronically or in paper indexed systems) about individuals must register with OIC and say why it holds that data and the use to which it will be put. It must hold the data in confidence, ensure that it is correct, and only retain it for the specified purposes and for as long as is required for those purposes, and not disclose it other than for the purposes specified in its registration.
Most (if not all) data holders have a clause which includes disclosure for the purpose of crime prevention and detection, or similar, which applicants sign up to, for example, when they apply for a credit card. It's not actually necessary, because the DPA contains specific provisions on this. Data-holders cannot refuse to provide information required for crime detection and prevention purposes using DPA as a reason.
And, don't forget, the right to confidentiality always belongs to the subject of that data, not the organisation holding it.
Just a thought, I need to wander off and check the OIC site to see whether JW congos are registered ...