Ordinarily I'd agree with GP but you are right that this is an unusual situation with potential for very detrimental legal consequence. What's being asked for

Ordinarily I'd agree with GP but you are right that this is an unusual situation with potential for very detrimental legal consequence. What's being asked for is absolutely a breach of the UK Data Protection Act and the providing company would be immediately legally liable for revealing this information. I see this public discussion (bearing in mind no names have been revealed) quite invaluable in raising awareness of this sort of harmful request.