Bring into Force Section 55 Penalties
The necessary steps should be taken to bring into force the amendments made to section 55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism).
- Section 55 of the DPA 1998 was replaced by section 170 of the Data Protection Act 2018, which makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller (Data Protection Act 2018, Section 170, legislation.gov.uk).
- Under section 196 of the DPA 2018, the maximum penalty for a section 170 offence is a fine on conviction on indictment, with no custodial sentence available (Data Protection Act 2018, Section 196, legislation.gov.uk).
- The recommendation that custodial sentences should be available for unlawful obtaining of personal data has not been implemented. No published government explanation for this decision has been identified to March 2026.
How was this evidence gathered?
Response
Not Accepted
Response
Not AcceptedThe Prime Minister stated on 29 November 2012: "I am instinctively concerned about this proposal. There is a real danger of this recommendation being used to curb freedom of the press. We need to consider this very carefully - particularly the impact this could have on investigative journalism." The Data Protection Act 2018 retained a broad journalism exemption (Schedule 2, Part 5) and did not implement this specific recommendation. Source: https://www.gov.uk/government/speeches/david-cameron-statement-in-response-to-the-leveson-inquiry-report
Published Evidence
Published assessments of progress from inspectorates, select committees, official progress reports, and other sources. Source type badge indicates whether each assessment is independent or government self-reported.
The increased sentencing powers for section 55 breaches (unlawfully obtaining personal data) under sections 77-78 of the Criminal Justice and Immigration Act 2008 were never brought into force. The DPA 2018 created new offences but the specific provisions Leveson referenced were not commenced.
View detailed findings
The specific statutory provisions Leveson recommended be brought into force were not commenced.