Aside: a downside of Know-Your-Customer laws (and anything else that requires your to upload personal data to web services) is now that data can be compromised as well. Maybe there should be less such requirements.
That sounds like the UK’s Data Protection Act, soon to be replaced with an EU successor that will apparently cause all sorts of interesting times if the UK tries to get rid of it post-Brexit.