Home Secretary should introduce jail sentence punishment for some data protection offences, committee of MPs recommends

Out-Law News | 06 Jul 2012 | 5:02 pm | 4 min. read

Individuals should face jail sentences for unlawfully obtaining, disclosing or selling personal data, a committee of MPs has recommended.

The House of Commons' Home Affairs Select Committee said that the typical penalties that are currently levied for breaching Section 55 of the Data Protection Act do not put people off illegally trading personal information.

The Home Secretary should introduce jail sentences as a possible punishment for data protection offenders, the committee said.

"We recommend that the Home Secretary exercise her power under section 77 of the Criminal Justice and Immigration Act 2008 to strengthen the penalties available for offences relating to the unlawful obtaining, disclosure and selling of personal data under section 55 of the Data Protection Act," a report by the committee into the business of private investigators said. "The current fine – typically around £100 – is derisory. It is simply not an effective deterrent."

The Home Affairs Select Committee is the latest Parliamentary committee to recommend that data protection offers go to jail. Last year the Justice Committee made the same recommendation to Government.

Section 55 of the Data Protection Act (DPA) states that is generally unlawful for a person to "knowingly or recklessly without the consent of the data controller obtain or disclose personal data or the information contained in personal data, or procure the disclosure to another person of the information contained in personal data" without the consent of those who control the data.

The current penalty for committing a section 55 offence is a maximum £5,000 fine if the case is heard in a Magistrates Court and an unlimited fine for cases tried in a Crown Court.

Under the Criminal Justice and Immigration Act the Justice Secretary has the power to introduce new regulations that would allow a custodial sentence penalty to be available for the offences under Section 55 of the DPA, but those powers have yet to be used. In 2008 the Act came into force without those powers being immediately available.

The UK's data protection watchdog, the Information Commissioner's Office (ICO), has long called for the new powers to be introduced. It previously said that a Government consultation on "increasing penalties for wilful misuse of personal information" held in 2006 had prompted overwhelming support for jail sentences to be handed out as part of the new laws.

Earlier this year Information Commissioner Christopher said that "chicken feed fines" were insufficient to deter individuals from 'blagging' information.

In its report the Home Affairs Select Committee said that personal data was "easier than ever" to access and that there were "new and unscrupulous suppliers" of the information that "may not be registered with the Information Commissioner and are unlikely to understand the rules under which they ought to operate."

The MPs said that private investigators and private investigation firms should both be regulated. It has recommended that individuals who breach data protection laws should have their licence suspended, should be barred from "engaging in investigation activity" and face "meaningful penalties for the worst offences."

Nobody should be able to call themselves a 'private investigator' without a licence to do so and their activities, and those of private investigation firms, should be governed by a new 'code of conduct', the Parliamentary committee said. The code should also apply to businesses that carry out "in-house investigation work" whose activities are "already subject to regulation, such as solicitors and insurance companies." Those businesses would not require "full licensing" but would need to be "registered" to do investigatory work, it said.

A new Security Industry Authority should regulate the private investigation industry, the MPs said.

"Both should be governed by a new Code of Conduct for Private Investigators, which would also apply to sub-contracted and part-time investigators," the report said. "A criminal record for breach of section 55 should disqualify individuals from operating as private investigators."

The Parliamentary committee said that although licensing would "impose an additional regulatory burden on the industry", the sector may be able to obtain "increased access" to some databases as a result of the "new safeguards" introduced through regulation.

"We recommend that the Government analyse the risks and benefits of granting increased access to certain prescribed databases for licensed investigators, in order to facilitate the legitimate pursuit of investigation activities," it said. "For example, a licence may confer the right to access the on-line vehicle-keeper database in certain circumstances."

"It should consider how this would interact with the changes proposed to data protection laws by the European Commission. The United Kingdom has rightly moved to a situation of information management rather than merely looking at data protection. We also recognise that appropriate sharing of data can prevent crime and contribute significantly to other outcomes that are in the public interest. However, any new access should be carefully monitored," the report said.

The MPs called on the Government to press ahead with plans to reform the private investigation industry and said a new licensing and registration regime could be implemented before the end of 2013.

The Parliamentary committee also called on the Government to do more to "sever the links between private investigators and the police forces". Among the actions it called for was a ban on retiring police officers working in private investigation for at least a year. It also said that "any contact between police officers and private investigators should be formally recorded by both parties, across all police forces".

The Government should also seek to merge the functions of the Information Commissioner, the Chief Surveillance Commissioner and the Interception of Communications Commissioner into a single 'Office of the Information and Privacy Commissioner' in order to ensure better protection for individuals' personal privacy, the MPs recommended.