In a letter dated 22 September 2013 to the Parliamentary Home Affairs Committee (the “Committee”) the Rt Hon Chris Grayling, Lord Chancellor and Secretary of State for Justice, has stated that the UK Government intends to conduct a public consultation on whether custodial sentences should be introduced for the offence unlawfully obtaining or disclosing personal data, contrary to section 55 of the Data Protection Act 1998 (“DPA”).
Mr Grayling’s letter relates to the Committee’s investigation into unlawful activity by private investigators. Firms of private investigators invariably collect personal data on individuals, often of a sensitive or confidential nature, and are therefore subject to the DPA. In the UK there have been well-publicised cases of private investigators acting unlawfully in obtaining personal data, for example by hacking voicemail messages or email accounts, and then selling such information to the media. Such activity is contrary to s.55 of the DPA, which prevents the unauthorised obtaining or disclosing of personal data where the controller is not permitted to do so by law or the public interest, and constitutes a criminal offence.
Introducing custodial sentences for breaches of s.55 of the DPA is not a novel concept. In 2006 the then Information Commissioner, Richard Thomas, argued that a two year custodial sentence should be introduced to “deter those convicted of trading unlawfully in personal information”; however no action was taken. Section 77 of the Criminal Justice and Immigration Act 2008 (“CJIA”) enables the Government to make an Order to introduce custodial penalties for breaches of s.55, and there were two consultations on the issued under the previous Labour Government. The present coalition Government has kept the matter under review and, following recommendations from Lord Justice Leveson, has decided to carry out a public consultation.
WAB Comment:
Although similar proposals have been made in the past, it is very possible that the proposed consultation will lead to custodial sentences being introduced for breaches of s.55 DPA, particularly in the wake of the phone-hacking scandals. Such reforms may be designed to tackle the unlawful trade in personal data which appears to have become an unfortunate part of the UK media industry. However, the offences under s.55 are not limited to private investigators or journalists, and any person or business which improperly accesses or trades personal data should be aware that if such activity may, in the future, result in custodial sentences.
