Data Protection: no new powers for the Commissioner in 2010?

So the Government has finally published its consultation on whether or not there should be custodial sanctions relating to selling or offering to sell personal data that have been unlawfully obtained (i.e. without the consent of the data controller).

At the moment, the offence under section 55 of the Data Protection Act 1998 is non-custodial with a £5,000 fine maximum. The Government is consulting on whether or not the maximum summary penalty at the Magistrates Court should be increased to 12 months in prison and/or a fine of up to the statutory maximum of £5,000. On indictment by the High Court, the maximum penalty could be increased to 2 years in person and/or a £5K fine. This brings it into line with similar offences, for example in the Computer Misuse Act.

So why the public consultation now? I think there are two drivers. First, there is a critical report coming from a Parliamentary Select Committee on the horizon; it took evidence on “Press standards, privacy and libel” and asked questions as to why there had been 18 months of governmental inaction on these penalties. After all, the relevant provisions to activate the custodial offences were hastily put in the Criminal Justice and Immigration Act in January 2008. Having a consultation before the Select Committee reports allows the Government to deflect that criticism.

Secondly, I think the public consultation boots the issue into the grass until after the General Election. For example, the consultation closes on Jan 7th 2010. Suppose it takes about 3 months to “reflect and decide”: that takes us to mid-March/April. As Parliament could be dissolved in April (likely) in relation to the General Election in May (latest June 3rd), it follows that there won’t be much time to introduce the necessary Regulations. The Easter weekend is April 2nd / 3rd; this removes another fortnight from the Parliamentary timetable.

Interestingly, the consultation states that “the Government proposes to bring in the new custodial penalties from April 2010, when the intention is that the ICO be given enhanced powers”. This means the Monetary Penalty Notice is supposed to start in April 2010 – something else I really don’t quite believe. I was assuming there would be a consultation on the extent of the powers that allow the Commissioner to fine data controllers?

Another problem is that in May/June, after the Election, an incoming Government has a difficult political mandate to follow with important economic problems to address. Do you really think they will spend Parliamentary time on a data protection issue?

That is why I am going down to the bookies to see whether I can get decent odds on these new powers and penalties not appearing in 2010.

Comments

[Toby Stevens]

Good analysis - they'll want to delay this because of the high likelihood that the first time the ICO uses his new powers will be against the government, so no point in bringing them in before the election...

[Graham Sadd - PAOGA]

I agree with Toby given the outrageous breaches by government. This government seem to think that 'lessons have been learnt' is an adequate response to data abuse. Look at Martin Sixsmith's treatment when trying to apply the Freedom of Information Act.

[Robin Wilton]

Toby - that rationale would only hold if you think the same government will be in place after as before the election... if not, it's a perfect poisoned chalice.