I suspect, though, that most of this data is 'Staff in Confidence' whereas by virtue of the sheer volume of sensitive personal information it should be handled as Secret or Top Secret.
Not just by virtue as I recall. I am sure that the JSP had a requirement to increase the protective marking for aggregated data (ie a cabinetfull of Restricted may be PM Confidential).
The only silver lining to this cloud is that the ID cards scheme will never be implemented. The No 2 ID campaign's support base is likely to number in the hundreds of thousands or even millions, as opposed to thousands ot tens of thousands.
This is a catastrophic breach of the Data Protection Act.