Privacy regulator the Information Commissioner's Office (ICO)
has long campaigned for an increase in penalties for breaches of
the Data Protection Act (DPA). The Government has agreed to back
the proposal and has launched a consultation on the issue.
"The custodial sentences should be set at the maximum available
under the power (i.e. twelve months’ imprisonment on summary
conviction and two years’ imprisonment on conviction on
indictment)," says the consultation.
The Government also proposes to introduce a new defence to the
offences for which jail terms are being introduced. People who are
engaged in art or journalism can claim exemption from the rule.
"The additional defence for anyone who can show that he was
acting for the special purposes (as defined by section 3 of the
DPA) with a view to publishing journalistic, literary or artistic
material, in the reasonable belief that the obtaining, disclosing
or procuring was in the public interest should be introduced
alongside the increased penalties," said the consultation.
The Government said that the ICO had been expressing concern
about DPA infringements for commercial gain since 2006. "The
Information Commissioner’s 2006 Special Report to Parliament 'What
Price Privacy? The unlawful trade in confidential personal
information' highlighted the corrosive effect of the trade in
personal information," said the consultation. "The report detailed
how the sums of money those engaged in such transactions can make –
up to £120,000 per month in one case. Individuals involved in such
a lucrative trade are unlikely be deterred by a fine only."
"At one point this trade appeared to subside. However, the new
Information Commissioner has recently called for the introduction
of these penalties. The Government has also listened to further
concerns from media organisations about the chilling effect which
such a penalty would have on legitimate investigative journalism,
and created a new defence for those who act for … special
purposes," it said.
The Government said that there are some offences related to the
misuse of personal information that already carry jail terms,
including some in the Identity Cards Act and the Commissioners for
Revenue and Customs Act. "However, the DPA is the central piece of
legislation which governs how personal data should be processed and
we believe it should be this piece of legislation which sets the
standards for offences relating to the knowing or reckless misuse
of personal data," it said.
"The Government therefore believes it is necessary to introduce
the increased penalties available to the courts for three reasons:
to provide a greater deterrent to those who seek to knowingly or
recklessly obtain, disclose or procure the disclosure of personal
data without the consent of the data controller or sell or offer to
sell personal data obtained in that way; to provide public
reassurance that those who are successfully prosecuted may,
depending on the gravity of the offence, be sent to jail; [and] to
achieve parity of approach across a number of disparate pieces of
legislation which deal with similar types of offences," said the
consultation.
The Government plans to introduce the changes in April 2010 at
the same time as the ICO's powers are strengthened by the Criminal
Justice and Immigration Act.
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
