By Stewart Room

Information Commissioner suffers severe setback in data security campaign

The UK Information Commissioner has suffered a severe setback in his long-running campaign to see the introduction of custodial penalties for "data theft" contrary to section 55 of the Data Protection Act 1998. Earlier this month the UK Parliament suspended the operation of an amendment to section 55 that would have introduced custodial penalties, following highly effective lobbying by the UK press and media.

The background to this story is very interesting. In May 2006 the Information Commissioner used special powers in the Data Protection Act to submit a report to Parliament titled "What price privacy?" in which he said that he had uncovered evidence of a and pervasive" black market trading in stolen personal data. He identified private detectives as being at the heart of the black market. The essence of his case was that the current criminal regime for these offences—which focuses only on fines—is insufficient to deter criminal behaviour. Therefore, he submitted that custodial penalties need to be introduced. The following month the UK Government issued a consultation on these proposals, demonstrating that the Commissioner and the Government had acted in concert to some extent, and in early 2007 the Government announced that it would introduce the necessary amending legislation. This was eventually introduced within the Criminal Justice and Immigration Bill, in summer 2007.

However, in the period between "What price privacy?" and the government's announcement that it would legislate, the commissioner published a follow-up report titled "What price privacy now?" (December 2006). This report marked the point when things started to go wrong for the Commissioner, because it "named and shamed" more than 30 leading UK press and media companies whom the commissioner said were involved in the black market. Not surprisingly, this incensed a considerable part of the press and media and the die was cast for a battle at the heart of Parliament, which the commissioner lost this month.

The state of play is that the Data Protection Act will be amended to give the government the power to introduce custodial penalties at a later stage. However, this compromise position looks to neutral commentators to be a challenge to the Commissioner: if he can stack-up the charges that he has made in his reports—in other words if he can secure convictions under the law as it presently stands—the Government might, just might, revisit the matter subsequently.
In the lead-up to the Government's decision to suspend the amendment, the Commissioner issued a press release that amounted to a plea to Government not to be deterred by the press and media lobby. The press release, dated 1st April 2008, can be found on the Commissioner's website at www.ico.org.uk/upload/documents/pressreleases/2008/section_55.pdf. After the Government suspended the amendment the Commissioner released another press release, which can be found at www.ico.org.uk/upload/documents/pressreleases/2008/section_55_statement.pdf.

Stewart Room is a Partner in the Privacy and Information Law Group at Field Fisher Waterhouse Solicitors. He may be reached at stewart.room@ffw.com.