
Let's not forget the Data protection Acts: I don't now how passing Personally identifying Data to the British Phonographic Association could be legal to a business (because that's what the BPI is, at the end of the day) that
(1) is unlikely to have clearance from the Security Industry Authority to perform Private investigations, and
(2) is probably not signed up to the Criminal Records Bureau, and is certainly not a Police Service under the Police Act;
furthermore given the above, they're highly unlikely to be able to obtain search/seizure warrants under their own remit - they have to get the Police to do that, and for that to occur there has to be an overwhelming burden of proof that wrongdoing - illegal wrongdoing, more specifically - has occurred.
So, yes, they might say they're protecting their customers, but in fact, reading between the lines, they're protecting their bottom line.
Let's say that a person, who for the sake of argument we'll call "Mr. Victim", has his details passed by CPW to the BPI; this includes a full event log of his browsing and downloading habits. Because it's also a customer file, his address, phone number, in fact his full contact details, are included in the data, and possibly even his bank details. Because this data can positively identity him, this is then passed to the police with a request for a full search warrant - basically a legal excuse for a rummage/fishing expedition.
The warrant is granted, and lo and behold, all manner of music files are seized when Mr Victim's home is raided by a dozen (he's described as a "major criminal at the centre of a criminal copyright distribution organisation" in the bundle of documents given to the judge who signed the warrant). On analysis, he's found to have downloaded the music files using a peer-to-peer software package, so yes, technically speaking he was also distributing them.
Cut to roughly nine months later, and the crown court. Mr. Victim is found guilty of copyright theft, fines, and sent home with a criminal record, and a VERY depleted bank account.
The very next day, backed by a digital freedom organisation that we will, for the sake of argument, call the EFF, he sues his former ISP, CPW, for three times the fine he received, on a civil charge of illegally releasing his data to the BPI. Forget the criminal conviction he's just received, he can still sue them for illegally passing his details over - it's contrary to the Data Protection Act. The court sees it his way, and Mr Victim changes his name to Mr Moneybags. He then sues just about everyone he can for using illegally obtained data to effect a prosecution. Only the High Court can judge the merits of that one, but you can bet that it'd side with Mr Moneybags, and quash the conviction on this legal technicality. You can imagine what kind of floodgates in civil litigation THAT would open up.
So. CPW're protecting their bottom line. Simple as, folks :)