I am head of Finance for a leisure company. I have a customer who had paid for this wife's gym membership during early 2005. They got divorced and he subsequently withdrew his contribution during 2006. He has written to me asking us to send him details (such as dates, classes etc) of any swim or gym classes his wife was booked into and attended/not attended during 2005 & 2006. I suppose his lawyers have asked him to get this info sop that they could ascertain she was not attending the Gym instead was playing away! I assume under the data protection act, despite him paying for her classes, we are not entitled to give him her whereabouts. We are a Trust and truth be known, we do not want any bad publicity from this request. Am I legally obliged to give him this information?