ICO Prosecution Powers Extension
The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
- The Data Protection Act 2018, section 170, provides the ICO with prosecution powers for unlawful obtaining or disclosing of personal data, and section 171 covers re-identification of de-identified data. The ICO may also issue enforcement notices and monetary penalty notices for breaches of data protection principles under Part 6 of the DPA 2018 (Data Protection Act 2018, legislation.gov.uk).
- The ICO's criminal prosecution powers remain limited to specific statutory offences rather than extending to any conduct constituting a breach of data protection principles more broadly. No published evidence that the recommendation was fully implemented has been identified to March 2026.
How was this evidence gathered?
Response
Not Accepted
Response
Not AcceptedThe Prime Minister stated on 29 November 2012: "I am instinctively concerned about this proposal. There is a real danger of this recommendation being used to curb freedom of the press. We need to consider this very carefully - particularly the impact this could have on investigative journalism." The Data Protection Act 2018 retained a broad journalism exemption (Schedule 2, Part 5) and did not implement this specific recommendation. Source: https://www.gov.uk/government/speeches/david-cameron-statement-in-response-to-the-leveson-inquiry-report
Published Evidence
Published assessments of progress from inspectorates, select committees, official progress reports, and other sources. Source type badge indicates whether each assessment is independent or government self-reported.
The ICO's prosecution powers were not extended to cover all breaches of data protection principles as Leveson recommended. The ICO has enforcement powers under the DPA 2018 but these are primarily administrative (fines, enforcement notices) rather than the criminal prosecution powers Leveson envisioned.
View detailed findings
Not implemented as specifically recommended. The ICO has administrative enforcement powers but not the expanded criminal prosecution powers Leveson proposed.