Mr Thomas is using special powers under the Data Protection Act
to present a 48-page report to Parliament which describes an
industry devoted to illegally buying and selling people’s personal
information such as current addresses, details of car ownership,
ex-directory telephone numbers or records of calls made, criminal
records and bank account details.
Private investigators, tracing agents and their operatives –
often working loosely through several intermediaries – are the main
suppliers, according to the report. Information is usually obtained
by making payments to staff or impersonating the target individual
or another official. Some victims are in the public eye; others are
entirely private citizens.
The ultimate buyers of illegally obtained personal information
include journalists, financial institutions and local authorities
wishing to trace debtors, estranged spouses seeking details of
their ex-partner’s whereabouts or finances and criminals intent on
fraud or witness or juror intimidation.
Up to £750 is paid for telephone account enquires, according to
one investigation. In another case, an agent was invoicing up to
£120,000 a month for tracing activities.
The report arises from investigations carried out by the
Information Commissioner’s Office, sometimes using search warrant
powers. Documents seized revealed evidence of a large scale market
in the trading of personal information.
It is an offence under section 55 of the current Data Protection
Act 1998 to obtain, disclose or procure the disclosure of personal
information without the consent of the organisation holding the
data. In the six years since the Act came into force, some 1,000
section 55 complaints reached the Information Commissioner’s
Office.
Between November 2002 and January 2006, the Information
Commissioner brought 25 prosecutions in Crown and Magistrates
courts in England and Wales. Convictions were obtained in 22 cases;
but the highest fine was £1,000 and most penalties were much
lower.
The penalties are too low, says the Commissioner, and they do
not have a deterrent effect.
"People care about their privacy and have a right to expect that
their personal details should remain secure from those with no
right to see them," said Mr Thomas. "Disclosure of even apparently
innocuous personal information can be highly damaging in some
situations – such as the address of a woman fleeing domestic
violence."
He warned that organisations can also be victims and warned them
to be fully aware of the risks of unauthorised disclosure. He urged
them to take strong precautions. "Plugging the gaps becomes ever
more urgent as the government rolls out its programme of joined-up
public services and joined up computer systems,” he said.
Mr Thomas added: “Low penalties devalue this serious data
protection offence in the public mind and mask the seriousness of
the crime, even within the judicial system. They do little to deter
those who seek to buy or supply private information that should
remain private."
His office proposes a prison sentence of up to two years for
people convicted by the crown courts and up to six months for those
found guilty by magistrates. "The aim is not to send more people to
prison," he said, "but to discourage all who might be tempted to
engage in this trade – whether as suppliers or buyers."
The Commissioner will publish a follow-up report in six months
to record responses, reactions and progress towards implementing
the report’s proposals. He is also hoping that the issue will be
raised in Parliament.
