Legal Information Centre

06 June 2008 by Mary Heaney

Custodial Sentences for Misuse of Personal Data?

Sinead Riach of Anderson Strathern, examines the UK Government's proposals to amend the Data Protection Act 1998 to impose custodial sentences for the deliberate and wilful misuse of personal data, in light of human rights considerations.

Recent years have seen an exponential growth of the internet and information technology, creating new challenges in respect of protecting the privacy and confidentiality of personal information. Added to this are widespread concerns about the increased commercial trade in personal data, which encourages unscrupulous purloining of personal information for often lucrative returns. Statistics indicate that tabloid journalists are key recipients of such data. Whilst journalists have a right to freedom of expression, as guaranteed by Article 10 of the European Convention on Human Rights (“ECHR”), our legal system requires that right to be balanced with the right of individuals to privacy.

Respect for privacy is a fundamental cornerstone of a democratic society. The right to a private life is protected by Article 8 of the ECHR. Article 8 creates a layer of protection in relation to all matters concerning the home and family life, and the Data Protection Act 1998 (“the DPA”) complements this by providing an additional layer of protection specifically in relation to an individual’s personal data.

Section 55 of the DPA creates an offence to knowingly or recklessly obtain, disclose or procure personal data, in the absence of the consent of the organisation holding the data. As the law currently stands, offences under this section are punishable only by way of a fine. In summary convictions, the fine is restricted to £5,000 but conviction on indictment can lead to an unlimited fine being imposed. In research conducted by the Information Commissioner, Richard Thomas, prosecutions brought under section 55 have to date generally resulted in relatively low penalties, either by way of minimal fines or conditional discharges. There has been a growing recognition in enforcement circles that the current legislative provisions are not tough enough to prevent or deter illegal trade in personal data, and that new, stronger measures are now necessary.

In May 2006, the Information Commissioner laid a special report before the Westminster Parliament for the first time, using his powers under the Data Protection Act 1998. The report, entitled 'What Price Privacy?', exposed details of the illegal trade in personal information and made recommendations to both the government and private sector. It was hoped that these recommendations would, if implemented, curtail the significant and escalating threat to personal privacy and send out a clear message that it was a crime to obtain unlawfully obtained information.


One of the key recommendations suggested by the Information Commissioner was an amendment to section 60(3) of the DPA, to increase the penalty for offences committed under section 55 to a custodial sentence. For convictions on indictment, he recommended the introduction of a maximum prison sentence of two years, or a fine, or both. For summary convictions, he recommended a maximum sentence of six months, or a fine, or both. He called on the Lord Chancellor, the Minister responsible for data protection policy, to introduce legislation into the UK Parliament as soon as possible.

Following on from the Information Commissioner’s report, in July 2006 the government published a consultation paper entitled 'Increasing Penalties for Deliberate and Wilful Misuse of Personal Data’. In the consultation paper, the government proposed amending the DPA to increase the penalties available to courts as recommended by the Information Commissioner, and invited responses on the proposals.

The government emphasised that the introduction of custodial sentences would not apply to front-line public sector staff who make a genuine mistake when sharing personal data for legitimate reasons. The consultation paper gives the example that it will not be an offence for an officer who shares data in order to protect a child, and who does so believing that they are authorised in law to do so, and it later transpires that they did not have such authority. It will also not be an offence if an officer is deceived into providing personal data. Instead, the offences will apply to those individuals who abuse their employer’s trust or who unlawfully obtain information from either public or private sector bodies.


The response to the consultation was published on 7 February 2007. Whilst the majority of respondents welcomed the proposals to introduce custodial penalties, believing this to be a more effective deterrent to the provisions currently in place, opponents argued that unlimited fines were more appropriate. The government agreed with the majority of respondents, and also found in favour of custodial sentences on the basis of human rights considerations. The government concluded that the current provisions were not sufficient to safeguard the rights of individuals, most notably the right to a private and family life. As such, the view was taken that increased penalties were necessary to protect people’s rights and any interference with journalists’ freedom of expression was justified and proportionate. The proposal to introduce a custodial sentence was therefore found to be compatible with the ECHR.

The Information Commissioner, in a follow up report published six months after the publication of ‘What Price Privacy’, welcomed the government’s consultation to increase sentences. The government has stated its commitment to introduce legislation as soon as parliamentary time allows. As yet there is no indication of when this will be. It will be interesting to see what the effects of a custodial sentence for deliberate misuse of personal data are. Could this see the end of tabloid journalism as we know it? What does seem likely is that the precarious balance between freedom of expression and the right to privacy may be about to tip in favour of the latter.

Sinead Riach at law firm Anderson Strathern


More News & Guidance