Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what support and guidance his Department provides to victims of crime committed under the Data Protection Act to ensure that (a) money is not paid by them or on their behalf to anyone who has unlawfully processed such data which have been paid by them or, if already paid, can be recovered and (b) obligations under anti-money laundering or proceeds of crime legislation are explained.

The Information Commissioner’s Office (ICO) applies for confiscation under the Proceeds of Crime Act 2002 in appropriate cases. The ICO communicates with victims throughout the prosecution case and if the ICO is to pursue either confiscation or make an application for compensation this is explained to the victim. More generally, the ICO is reviewing processes for supporting victims in light of the forthcoming implementation of the Victims Directive.

In cases where organisations do not comply with the Data Protection Act 1998 (DPA) the ICO has a range of powers to take action, including the power to serve a Civil Monetary Penalty of up to £500,000. In the most serious cases, section 55 of the DPA makes it an offence for a person to knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller. The offence is punishable by an unlimited fine.

Figures for prosecutions and cautions for DPA related offences the last six years are in the table below.

The figures for 2012/13 to 2014/15 years can also be found in the ICO’s annual reports at the link below:

https://ico.org.uk/about-the-ico/our-information/annual-reports/