Yes it's against the Data Protection Act. Basically where any bank details are concerned, you are only allowed to hold them until you have processed the original payment that was agreed when the cardholder handed over the card details. He's broken the law quite severly, he's illegally accessed someone elses bank account with what is essentially stolen information, and withdrawn money. Sounds like an issue for the police to me. If he's holding my card details aswell instead of disposing of them, I want to know about it! If he wants to avoid having his company shut down and having a criminal record/prison sentence, he should start behaving like a professional. Tarty Adam for instance have never tried to sell me anything, he always offers advice and will recommend which part I should get regardless of whether he has more of one in stock, or whether his return is greater on one than another.