WIREDGOV

Custodial sentences should be introduced for breaches of the Data Protection Act, MPs on the Justice Committee urge the Government in a report.


Concerns
Breaking data protection laws can be extremely profitable and the impact of the crime can be severe. The report raises concerns that fines provide an inadequate deterrent when the financial rewards for illegal behaviour are so great.

Sir Alan Beith, the Chair of the Justice Committee said:

"Using deception to obtain personal information – sometimes known as blagging – or selling it on without permission are serious offences that can cause great harm.

Fines are used to punish breaches of data protection laws, but they provide little deterrent when the financial gain exceeds the penalty.

"Magistrates and Judges need to be able to hand out custodial sentences when serious misuses of personal information come to light. Parliament has provided that power, but Ministers have not yet brought it into force - they must do so.

Potential misuses of personal data

Potential misuses of personal data are also not being fully investigated, the MPs warn, because the Information Commissioner does not have the power to compel private sector organisations to undergo information audits. If the Commissioner had been able to compel audits of insurance companies and personal injury lawyers the issues around referral fees might have been identified and tackled sooner.

Sir Alan Beith MP added:

"The Information Commissioner's lack of inspection power is limiting his ability to identify problems or investigate potential data abuses.

Ministers must examine how to enable the Commissioner to investigate properly without increasing the regulatory burden on business or the public sector."

Referral fees

The committee welcomes the Government's commitment to ban referral fees in personal injury cases. The MPs call on Ministers to take into account the fact that referral fees reward a range of illegal behaviour. The report concludes that banning referral fees, together with custodial sentences for breaches of Section 55 of the Data Protection Act, would increase the deterrent and reduce the financial incentives for such offences.

Case studies

1. In one case a nurse was providing patient details to her partner who worked for an accident management company. A fine was imposed of £150 per offence, but accident management companies pay up to £900 for on client's details.
2. A woman whose husband had been jailed for sexual assault accessed the bank account details of the victim. The woman attempted to monitor the victim's spending and social activities but was only fined £100 per offence.
   
   
   
   

   Further Information

   Report: Referral fees and the theft of personal data: evidence from the Information Commissioner 
   
   Uncorrected oral evidence: The work of the Information Commissioner 
   
   Justice Committee