Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what information his Department holds on the (a) extent of criminal activity and (b) amount of unlawfully obtained benefit which has occurred contrary to provisions of the Data Protection Act 1998 in each of the last six years for which records are available.

The Information Commissioner’s Office (ICO) applies for confiscation under the Proceeds of Crime Act 2002 in appropriate cases. The ICO communicates with victims throughout the prosecution case and if the ICO is to pursue either confiscation or make an application for compensation this is explained to the victim. More generally, the ICO is reviewing processes for supporting victims in light of the forthcoming implementation of the Victims Directive.

In cases where organisations do not comply with the Data Protection Act 1998 (DPA) the ICO has a range of powers to take action, including the power to serve a Civil Monetary Penalty of up to £500,000. In the most serious cases, section 55 of the DPA makes it an offence for a person to knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller. The offence is punishable by an unlimited fine.

Figures for prosecutions and cautions for DPA related offences the last six years are in the table below.

The figures for 2012/13 to 2014/15 years can also be found in the ICO’s annual reports at the link below:

https://ico.org.uk/about-the-ico/our-information/annual-reports/