No one, including government, can enumerate who holds and trades UK residents' personal data. There is no registration obligation for data brokers, in contrast to California's registry and Delete Act, and DSIT's call for evidence on data brokers and national security acknowledged the blind spot. ICO enforcement is rare and fragile; its 2020 Experian enforcement notice on offline data broking was largely overturned on appeal. Consumers have no practical way to discover or delete broker-held profiles, and ORG's campaigns are ad hoc.
Broker data feeds scams, discriminatory pricing and, in DSIT's own framing, hostile-state targeting. Individual rights are unusable against entities you cannot name. A register converts an invisible market into a governable one.
Statutory data broker registration administered by the Information Commission, with a one-stop deletion mechanism on the California Delete Act model. In the interim, a funded independent observatory could map the UK broker market.
// Build now: First artefact: independent UK data-broker observatory (fill's named interim); statutory register is the state-led end-state.
Nobody can enumerate the UK data brokers feeding scams and hostile-state targeting; California's registry-and-deletion model is copyable and the market is unowned.