The ICO has announced three successful prosecutions for unlawful obtaining or disclosing of personal data under s55 of the Data Protection Act 1998, all of which involved employees accessing or transferring personal data in their own self-interest.
In the first case, a former senior local government officer accessed the authority’s recruitment system and passed on the recruitment packs of rival job applicants, including the name, address, telephone number and CV of each candidate, to his partner who had applied for a job at the Council. In the second, a former administrator at Heart of England NGS Foundation trust who inappropriately accessed medical records related to seven family members and seven children known to her, without authorisation. The third case involved a former administration assistant at a used car dealership who forwarded several work emails containing personal data of customers and colleagues to her personal email account, weeks before resigning from her role.
In all three cases, the defendants pled guilty to unlawfully obtaining or disclosing personal data, and were fined and ordered to pay costs and a victim surcharge. These cases were prosecuted under the 1998 Act, as the relevant behaviour took place prior to the coming into force of the Data Protection Act 2018. However, the criminal offence has been retained in the 2018 Act - and in fact widened to incorporate the knowing or reckless retention of personal data without the consent of the data controller.
We see these cases as a timely reminder that employees who ‘snoop’ and access personal data outside of their employment duties are not simply in breach of their employment contract or the GDPR, but are also likely to face criminal prosecution. As Elizabeth Denham likes to say, “data crimes are real crimes.”
This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.