Summary
The Information Commissioner is determined to stop the illegal trade in personal information.
He has attached great weight to clause 76 – increasing the penalties for the existing criminal offence immediately – and would of course prefer to see it remain in the Bill. But he recognises that the first New Clause will still allow the Secretary of State to increase the penalties for the data protection offences of disclosing, obtaining or procuring information without consent. Section 55 of the Data Protection Act 1998 means that this has been a criminal offence for many years, but has only attracted derisory penalties. The Commissioner’s 2006 report “What Price Privacy?” exposed a hidden, pernicious and extensive trade in personal information which damages individuals, the organisations from which data is obtained and society at large. Personal data at risk includes financial, medical, and police records. The New Clause sends a strong signal that this conduct is unacceptable. The Commissioner hopes that this will act as a real deterrent to any sectors still contemplating illegal access to personal data. He will press hard for immediate implementation if the practices persist.
The case for increased penalties for the data protection offence has strong and widespread support – notably from organisations holding large data collections. Clause 76 made good progress through Parliament. The Information Commissioner is pleased that the government has resisted substantial pressure to abandon Clause 76 altogether. His aim has always been to deter and the first New Clause will still be a powerful Sword of Damocles hanging over the heads of anyone involved in obtaining personal data.
The Information Commissioner strongly values press freedom and freedom of speech, but hopes that all journalists will steer well clear of the sort of practices which – in the words of one newspaper – will “poison the well for all journalism”. The existing offence does not threaten legitimate and responsible journalism. To be illegal the activity must be carried out knowingly or recklessly and there are strong public interest and other defences. But it would be very difficult to justify the sort of activities exposed by the Commissioner in public interest terms. The available public interest defence was not even suggested in those cases where convictions were secured which involved wholesale obtaining of tittle-tattle by deception or payment. To allay media concerns, however, the Commissioner is not opposed to the second New Clause which broadens the public interest defence. He will also be publishing a Statement of Prosecution Policy which very clearly recognises the importance of freedom of the press.
Public and political concerns about the security of personal data have never been higher. This is the first legislative opportunity after recent major data losses to demonstrate the seriousness of safeguarding peoples’ personal information. It will difficult for measures aimed at preventing accidental data loss to be taken seriously if there is not a step changes in the approach to deliberate data breaches. Parliament must send the signal that it is willing to tackle data security problems and reinforce sensible data protection.
View the full briefing document (PDF)