Feeds

Lords defy Government by proposing criminalisation of data rogues

Disclose our info and you'll pay

Combat fraud and increase customer satisfaction

The House of Lords has proposed making it a criminal offence to disclose personal information intentionally or recklessly. The Lords passed an amendment to the Criminal Justice and Immigration Bill, defeating the Government.

If it is to become law the amendment will need to be approved by MPs in the House of Commons. The Government opposed the amendment but was defeated by 134 votes to 130.

The amendment would make it a criminal offence to "intentionally or recklessly disclose information contained in personal data to another person, repeatedly and negligently allow information to be contained in personal data to be disclosed, or intentionally or recklessly fail to comply with [their] duties".

"Data controllers currently do not face anything like adequate sanctions if they intentionally or recklessly disclose information, or indeed are repeatedly negligent," said Liberal Democrat peer Baroness Miller of Chilthorne Domer, introducing the amendment.

"Goodness knows, this is not exactly a new issue. The Government have had time to address it. In 2002 in another place [the House of Commons] my honourable friend Paul Burstow revealed that a total of 1,354 government-owned computers had gone missing over the previous five years, while much more recently, as noble Lords will be aware, vast amounts of data, whether from Her Majesty’s Revenue and Customs or the health sector, have been lost," she said.

"The issue has been around for a long time, and not only in government sectors. The private sector, as we know, can be negligent, and it can do all sorts of things with data that it should not do. Both the public and private sectors need to be covered by further sanctions, which is the reason for our amendment," said Miller.

Until recently the bill contained a clause that would introduce jail sentences of up to two years for people who steal or sell personal data, but the Government has decided not to activate that clause of the law.

The new amendment would create a new offence, but Government minister Lord Hunt of Kings Heath opposed the change, saying that the Government wanted to wait until it had reviewed past problems with data loss before legislating.

"The Government are involved in a number of reviews on these matters in the light of some of the well publicised incidents that have taken place," he said. "Just as noble Lords usually say that the legislation I bring forward is premature and has not had enough consideration, I have to say that that is our position at the moment."

"The Government recognise the genuine and legitimate concerns expressed by noble Lords both in this debate and in Committee, but a number of imminent reviews and reports will inform both the actions that the Government have to take as a Government and whether legislative changes should be made. That is why we think it would be premature to legislate at this point," he said.

Miller said that the public could not afford a wait. "Basically the public will have to continue with this lack of protection for at least another year or two, during which time, at the rate of the past 12 months, millions more pieces of data will have gone missing," she said.

The Conservative Party proposed a weaker amendment which would only apply to public bodies or workers on contract to the public sector, but Miller said that it was a false distinction. "Citizens do not mind who lost the data; it is irrelevant to them. What is important is that it is their data that have been sold, lost or left on rubbish heaps and it is they who are affected by it," she said.

The Information Commissioner Richard Thomas has previously called for a law that would punish people or organisations that put other people's personal data at risk. In January the Parliamentary Justice Committee backed Thomas's calls for such a law.

Copyright © 2008, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

SANS - Survey on application security programs

More from The Register

next story
EU: Let's cost financial traders $400m a day, because EVIL BANKERS. Right?
Wait 'til this one hits your pension fund where it hurts
Systems meltdown plunges US immigration courts into pen-and-paper stone age
Massive outage could last four weeks, sources claim
RIP net neutrality? FCC boss mulls 'two-speed internet'
Financial fast track to replace level competitive playing field, report claims
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
UK.gov chucks £28m at F1 tech for buses and diggers plan
Well, not really F1 but who's heard of LMP and VLN*?
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.