APPENDICES
2002 and January 2006, only 2 out of 22 cases produced total fines that amounted to more than £5000.399
¶Investigation and enforcement of s55 offences 4.71 Under schedule 9 of the Act, the ICO has powers of entry and inspection if it has reasonable
grounds for believing that an offence has been committed. Mr Thomas noted that the ICO needed a warrant from a district judge to exercise these powers.400
¶4.72 In terms of the practicality of investigation and enforcement of s55, Mr Thomas explained
that s55 enforcement was the responsibility of a small investigations team composed of former police and customs officers and that the ICO felt that its teams were not large enough and were under-resourced.401 Mr Thomas noted that if there is evidence of corruption and dishonest behaviour, which carries a stronger sentence, then it is inevitable that the case will be handed to the police and to the Crown Prosecution Service.402 For example, he recalled that there was evidence that private detectives were paying money to people inside the DVLA, British Telecom and the police service to get information. As this was a far more serious matter than a breach of s55, the Crown Prosecution Service took over responsibility for prosecution.403
¶4.73 In his evidence, Mr Graham noted that there are practical challenges in the investigation of
the involvement of individual journalists for s55 offences, including demonstrating the degree of knowledge on the part of the individual journalist, addressing the public interest defence available to the media, and in the absence of a power of arrest securing any co-operation from a journalist who would undoubtedly say that he or she does not reveal sources.404 However, he commented that none of these considerations of principle and practicality should prevent the proper enforcement of the criminal law against the media.405
¶4.74 In relation to the scope of s55, Mr Graham explained that in some circumstances personal
data could be obtained in a way that suggests the commission of offences under s55 of the Data Protection Act and other legislation. The investigation of offences which carry custodial sentences are, in practice, given precedence over the investigation of offences which do not, and the police will lead investigations where offences that carry a custodial penalty are suspected.
¶Amendments to s55 4.75 The Department of Constitutional Affairs (DCA) commenced a consultation exercise on 24
1919July 2006 in relation to the possibility of increasing penalties for deliberate and wilful misuse of personal data. The DCA published their response on 7 February 2007, which contained the following summary:
¶Appendix 4 | Legal Materials
(a) Respondents generally welcomed the introduction of custodial penalties to provide a deterrent to potential offenders, to provide public reassurance that offenders would receive the appropriate sentence and to achieve parity with a number of disparate pieces of legislation which deal with similar types of offences. (b) The majority of respondents agreed that custodial penalties would be an effective deterrent because it would demonstrate the legal importance of data protection compliance and the seriousness of the offence. A few respondents did not agree with the proposal and argued that unlimited fines were more appropriate. (c) Many respondents agreed with the proposed length of custodial sentence and that the courts should have access to the same sanctions as it would for similar offences. A minority of respondents argued that a maximum sentence of twelve months on summary conviction and five years on indictment would be more effective.
¶4.76 The Criminal Justice and Immigration Bill contained a clause to introduce custodial sentences
for s55 offences. A number of press organisations opposed this proposal and the clause was amended such that custodial sentences could be introduced only after a Ministerial Order, the Order being preceded by consultation with media organisations and other interested parties.406 This is now found in s77 of the Criminal Justice and Immigration Act 2008 (CJIA).
¶4.77 The other amendment to the DPA contemplated by the CJIA is the inclusion of a further
defence to the s55 offence, which is of specific relevance to journalists. This was enacted in s78 of the CJIA, although this section is not yet in force. If brought into force, it would be a defence where a person acted for special purposes, including journalism, with a view to the publication by any person of journalistic material and in the reasonable belief that the obtaining, disclosing or procuring of that information was in the public interest. The amended defence is broader in terms than the defence currently set out in s55 DPA: the extended defence contemplated by s78 CJIA does not require a journalist to show that their conduct in obtaining, procuring or disclosing the data is objectively justified in the public interest, but introduces a subjective element, namely that the journalist has a reasonable belief that the conduct is in the public interest and that they acted with a view to publication of journalistic material. Mr Graham described the proposed amended defence as a "very, very good increased defence for journalists".407
¶4.78 In terms of the possible amendments to the legislation which are currently found in s77 and
s78 of the CJIA, Mr Graham explained that the current position is that the Government is awaiting the outcome of the Inquiry before taking a decision on activating ss77 and 78.408
¶4.79 There is support for the amended defence from a number of media organisations. For example,
1920News International submitted that the statutory language of s55 at present produces the bizarre result that a journalist investigating allegations of improper conduct in the honest and reasonable, though mistaken, belief that publication would be in the public interest would be able to establish an exemption from civil liability but unable to establish a defence to a criminal charge arising out of the same facts. It is further argued that the importance of that amendment is that Parliament has expressly reconfirmed in the field of regulation of misuse of personal data by media organisations that the focus must be on whether the media