Stolen identity: regulating the illegal trade in personal data in the ‘data-based society’

In May 2006, the UK Information Commissioner’s Office (ICO) presented a report to Parliament entitled What Price Privacy? The report highlighted the extent of the illegal trade in personal data. Arguing that the risk of security breaches had increased largely as a result of the rise of the ‘data-based society’, the ICO called for a change in the legislation to permit jail sentences of up to two years in respect of offences under section 55 of the Data Protection Act 1998. In February 2007, the UK government stated its intention to adopt that recommendation. This paper examines the current UK policy approach to regulating the illegal flow of personal information, and the lead taken by the UK Information Commissioner. Reference is made to the ‘privacy toolbox’, where data protection legislation is combined with measures such as codes of practice and privacy impact assessments (PIAs). Comparisons are made with the work of overseas regulators. In addition, the current regulatory framework regarding section 55 offences is examined, with the author attending an ICO prosecution hearing in December 2006. The paper concludes by arguing that a greater emphasis needs to be placed on the assessment of privacy risks posed, in particular, by the expansion and proposed merger of government databases. Adoption of PIAs could help achieve this.