Without defending Klout, who do seem to go somewhat further than others on this front, the Data Protection Law in the UK isn't quite as strict as the post implies. The issue of consent, for example, is part of a chain of ors, not ands — i.e. it's a sufficient but not necessary condition for processing someone's personal data. If consent was always required for anyone to ever do anything with your information, the press, for example, would never be able to publish critical articles about anyone.