Out-Law / Your Daily Need-To-Know

Move to introduce jail time as potential punishment for UK data protection breaches stalls

Out-Law News | 24 Oct 2014 | 4:36 pm | 2 min. read

Another attempt to introduce jail sentences as a possible punishment to individuals who access or disclose personal data in breach of data protection rules has stalled in the UK parliament.

Lord Marks of Henley-on-Thames had proposed draft new regulations that would, if introduced, make imprisonment a possible penalty for certain data protection offences for the first time in the UK.

The proposals were contained in an amendment to the draft Criminal Justice and Courts Bill which is currently making its way through the UK parliament. Lord Marks did not move the amendment to a vote during a House of Lords debate on the Bill earlier this week after other peers criticised the timing of the proposals.

However, the Liberal Democrat peer suggested that he may re-table the amendment again, alongside other proposals he has drafted, at a later stage of the Bill's progress through the Lords.

"I entirely accept that the complexity of these amendments, and the fact that the government and the opposition have had so little time to consider them, means that it would be wrong of me to press them to the vote today," Lord Marks said during the debate on Monday.

Under his draft amendment, an individual who is found guilty of an offence under Section 55 of the Data Protection Act (DPA) could be jailed for up to two years. They could, in addition, be issued with a fine for their crime.

Under section 55 of the DPA, it is generally unlawful for a person to "knowingly or recklessly without the consent of the data controller obtain or disclose personal data or the information contained in personal data, or procure the disclosure to another person of the information contained in personal data" without the consent of those who control the data.

The current penalty for committing a section 55 offence is a maximum £5,000 fine if the case is heard in a Magistrates Court and an unlimited fine for cases tried in a Crown Court.

"To put it bluntly, the threat of fines is frequently insufficient as a punishment," Lord Marks said during the Lords debate. "There is a risk that payment of fines may be regarded and treated as no more than a necessary expense by unscrupulous publishers who act with intent to circumvent the Data Protection Act."

The UK parliament previously passed legislation which allows new regulations to be introduced to make imprisonment a possible penalty for section 55 offences. However, the power to introduce those new regulations has never been acted on, despite heavy lobbying from the Information Commissioner's Office, and recommendations from some parliamentary committees as well as Lord Justice Leveson in his inquiry into press culture, behaviour and ethics.

Lord Marks has also drafted an amendment which, if introduced, would create a new public interest defence that journalists could rely on to avoid prosecution for activities carried out in breach of section 55 of the DPA.

Journalists should be able to obtain or disclose personal data unauthorised without that activity constituting a criminal offence if they are of "the reasonable belief" that their actions are justified in the public interest, according to Lord Marks' proposed alteration to data protection laws.

The next report stage for the Criminal Justice and Courts Bill is scheduled for 27 October.