Anything in the public domain is fair game but I sue debtors for a living and you have to be really careful where you get info from and what you do with it, it doesn't just apply to businesses and it doesn't just apply to electronic data.
From what no-inferno mark was posting it appeared the information would be coming from a source not publicly available such as a police data base, if that's the case the friend is breaching the act looking up the information for something that isn't directly related to the reason they have access to it (i.e. to do their job), anyone he passes the information to who uses it is also in breach of the act even if they don't know how he got the data - max fine has just gone up to £1/2m.
Trust me on this one, I actually know what I'm talking about for once.