I'm also unsure of the data protection implications.

Good point, with the EC breathing down our necks, PC doesn't mean PC in this land. It would be a good idea to have a register, but it may need to be confidential. i.e. submit a number and the keeper will tell you if it's registered or not: I'll have a word with our legal eagles in the morning, I'll not say i'll keep such a register(which wouldn't seem to be a big job), but I'm not saying I won't (politician's answer).