The new Data Protection Act covers paper based records as well but this part of the Act does not come into force until next year.(posted 8602 days ago)For the time being, I suggest your write back to the Data Protection Compliance Officer at Halifax with a copy of Tony Hater's posting. You might also want to send a letter to the Data Protection Registrar with copies of the correspondence between you and Halifax, I'm sure they'd be very interested.
Good luck
Pendle