The Data Protection Act 2018, enforced on 25th May 2018 has some important enhancements over the previous legislation. In this post eNacyH wants to highlight some of the Offences Relating to Personal Data, namely Chapter 12, Part 6, Section 170.
Unlawful obtaining etc of personal data
- It is an offence for a person knowingly or recklessly..
- to obtain or disclose personal data without the consent of the controller,
- to procure the disclosure of personal data to another person without the consent of the controller, or
- after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.
- It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining..
- was necessary for the purposes of preventing or detecting crime,
- was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
- in the particular circumstances, was justified as being in the public interest.
- It is also a defence for a person charged with an offence under subsection (1) to prove that..
- the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,
- the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or
- the person acted—
- for the special purposes,
- with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
- in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.
- It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.
- It is an offence for a person to offer to sell personal data if the person.
- has obtained the data in circumstances in which an offence under subsection (1) was committed, or
- subsequently obtains the data in such circumstances.
- For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.
- In this section—
- references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
- where there is more than one controller, such references are references to the consent of one or more of them.
The supervisory authority for data protection and privacy in the UK, the Information Commissioners Office (ICO) has recently prosecuted individuals under the old legislation (DPA 1998, Section 55), so watch out for future prosecutions under Section 170.
Why this post? Well we are afraid to say that clients have needed advice on this matter when employees still think that they can simply retain, purloin or otherwise obtain personal data from their employer prior to leaving and then use the personal data in their new employment, or for other purposes.
There is now no ambiguity in this matter, fact, it’s a criminal offence!
eNacyH ensures that this topic is covered fully in their training offerings; to ensure employees, contractors and any other bodies processing personal data under the authority of the data controller are left in no doubt about it.