Trading in personal data could mean jail

Last week, the Department for Constitutional Affairs (DCA) announced it would be amending s 60 of the Data Protection Act 1998 (DPA 1998) to raise the punishment to up to six months imprisonment on summary conviction, and up to two years imprisonment on conviction on indictment.

Currently, it is an offence punishable by a fine of up to £5,000 on summary conviction or unlimited on conviction on indictment, under s 55 of the Act for anyone “to sell or offer to sell personal data which has been (or is subsequently) obtained/ procured knowingly or recklessly without the consent of the data controller”.

The amendments follow concernsraised in the DCA consultation paper, Increasing Penalties for Deliberate and Wilful Misuse of Personal Data, launched last July, and in an earlier information Commissioner’s Office report that existing penalties were an insufficiently strong deterrent.

Richard Thomas, the Information Commissioner, says: “A custodial sentence will act as a deterrent for individuals who are tempted to obtain or disclose personal information unlawfully.”

Data protection specialist Peter Carey, editor of the Privacy and Data Protection Journal, says he expects custodial sentences will be reserved for repeat and serious offenders.

“I think the courts will welcome the extra power that they will have and will use it appropriately. I support the use of custodial sentences because some of the things done which give rise to the offence are very serious invasions of people’s privacy.

“Section 55 is very specific and narrowly drawn and should not inhibit normal investigative journalism although some tabloid journalists who take things too far will be at risk as will private detectives who operate in an unlawful way.”

A spokesperson from the human rights group Liberty says: “Data protection rights are very important and this increased penalty, provided it is not used unnecessarily, doesn’t alarm us unduly.”