---

Criminal Justice and Immigration Bill

Thank you, Madam Deputy Speaker. The House will be aware that on Report in another place their lordships proposed an amendment to provide for a new criminal offence for data controllers who intentionally or recklessly disclose personal information, repeatedly and negligently allow information to be disclosed, or intentionally or recklessly fail to comply with the data protection principles. During the debate, the Government argued that it would be premature to propose an amendment of such a nature and that a considered view should be taken on what measures are necessary to strengthen the protection of personal data once the recommendations of the various ongoing data protection reviews are published. We believe that the Lords amendment is drafted extremely broadly and is therefore capable of penalising relatively minor infringements, just as it seeks to penalise very serious infringements, as it does not discriminate between them. For example, a person writing letters and including someone's details in them repeatedly, possibly as a result of being ill-advised or ill-trained or of not looking anew at the letters they are sending out, could fall foul of the offence, but that is a lower level of infringement than some of the examples of data going missing that we have all become aware of over the past few months. That is a concern. In addition, criminal proceedings require a significant call on the public purse in terms of court and judicial resources and legal aid, and a criminal conviction is a disproportionate means of achieving the kind of behavioural change the Information Commissioner is trying to influence in information management. We therefore propose the amendment in lieu as a suitable alternative, and I want to take the House briefly through its components. The amendment inserts new sections into the Data Protection Act 1998. Proposed new section 55A will confer on the Information Commissioner a power to impose a monetary penalty notice on a data controller. The power will be exercisable in circumstances where the Information Commissioner is satisfied that a data controller has committed a serious contravention of the data protection principles. However, the commissioner must also be satisfied that the contravention was either deliberate or that the data controller knew, or ought to have known, of the contravention risk, and that the contravention would be likely to cause substantial damage or substantial distress, but he failed to take reasonable steps to prevent that contravention. The commissioner will determine the amount of the monetary penalty.