News & Events

The Data Protection Act – a useful weapon against bad employees?

Submitted By Firm: Addleshaw Goddard

Contact(s): Michael Leftley, Sarah Harrop

Author(s):

Sara Sayeed

Date Published: 8/18/2016

Article Type:

Share This:

Introduction


For many businesses today, information is their most valuable asset. The stated purpose of the Data Protection Act 1998 ("DPA") is to ensure that organisations, business and the government keep personal data secure and process it fairly and lawfully. It is perhaps not surprising, therefore, that organisations tend to view the DPA as legislation with which they must comply or face the consequences. It can, however, be a useful weapon in an organisation's armoury against bad employees.

The recent case of Mark Lloyd, summarised below, is a helpful reminder that under s55 of the DPA, a person commits an offence if they knowingly or recklessly, without the consent of the data controller, either (i) obtain or disclose personal data or the information contained in personal data, or (ii) procure the disclosure to another person of the information contained in personal data.

Lloyd

Mark Lloyd was a former employee of Acorn Waste Management Limited ("Acorn"). When Mr Lloyd left Acorn, he sent information relating to 957 of its clients to his personal email account to use in his new job with one of Acorn's competitors. The information contained the personal data of Acorn's clients, such as their contact details and purchasing history.

Acorn reported Mr Lloyd to the Information Commissioner's Office (ICO), which prosecuted him under s.55 of the DPA. The Magistrates' court convicted him and fined him £300. He was also ordered to pay a victim surcharge of £30 and Acorn's costs of £405.98.

In 2014/15 alone, the ICO prosecuted 13 s.55 cases and secured 10 criminal convictions; the previous year, it reported 12 criminal convictions pursuant to s.55. The subject matter of the cases covers a broad scope. By way of example:

  • In November 2014, a pharmacist was prosecuted and fined £1,000 for unlawfully accessing the medical records of family members, work colleagues and local health professionals;
  • In March 2013 a former manager of a health service was fined £3,000 for obtaining the sensitive medical information relating to over 2,000 people to use for his new business;
  • In March 2013, a former receptionist at a GP surgery was fined £750 (and ordered to pay the victim a surcharge and costs) for unlawfully obtaining sensitive personal information relating to her ex-husband's new wife; and
  • In December 2012, a Barclays bank employee was fined £5,000 for accessing the bank statements of her partner's ex-wife.

Section 55 of the DPA – the offence and its limitations

As noted above, under s.55 of the DPA, a person commits an offence if they knowingly or recklessly, without the consent of the data controller, either (i) obtain or disclose personal data or the information contained in personal data, or (ii) procure the disclosure to another person of the information contained in personal data. A person convicted of an offence under s.55 is liable to a fine in summary proceedings in either the Magistrates' Court or the Crown Court.

However, there are limitations to the ICO's ability to prosecute such offences. The ICO must first obtain the consent of the Director of Public Prosecutions before taking any steps to prosecute. Also, there is a full defence to s.55 if the person shows:

  • That the obtaining, disclosing or procuring was necessary for the purpose of preventing or detecting crime, or was required or authorised by law;
  • They acted in the reasonable belief that:
    • They had the right in law to obtain or disclose the data/information or, as the case may be, to procure the disclosure of the information to the other person; or
    • They would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or
  • That in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.

Since 12 March 2015, the cap of £5,000 which Magistrates' courts could fine s.55 offenders has been lifted, though historically, fines have rarely reached £5,000, even in the Crown Court, where no such cap applied.

It has therefore been argued that there is no adequate deterrent to the DPA's sole criminal offence, as offenders may take the view that the commercial value of the stolen data may exceed that of any fine imposed. For example, in R v Nagra (2016), Ms Nagra had sold 28,000 customer records which she had obtained whilst working at a car rental company for £5,000, but was only fined £1,000.

The ICO and various pressure groups have long called for custodial penalties to be introduced for breaches of s.55. Although the Criminal Justice and Immigration Act 2008 introduced a power to amend s.55 to include a custodial sentence, that provision has still not been implemented. Christopher Graham, who stepped down recently after seven years as Information Commissioner, commented earlier this year that:

"The fines that courts are issuing at the moment just don't do enough to discourage would-be data thieves...we'd like to see the courts given more options: suspended sentences…and even prison in the most serious cases. With so much concern about the security of the data, it is more important than ever that the courts have at their disposal more effective deterrent penalties than just fines. People who break the criminal law by trading in other people's personal information need to know that they will be severally punished and could even go to prison."

Tactical advantages of s.55 DPA

Despite the argument that s.55 lacks teeth, that does not mean that it is an entirely blunt instrument. There are tactical advantages to deploying s.55 in data breach scenarios:

  • s.55 is drafted more widely than other criminal offences relevant to data breach scenarios, for example:
    • The Computer Misuse Act 1990 requires "unauthorised access" to a device. That may not be applicable when the data has been appropriated by an employee who was authorised to utilise the device from which the data was taken.
    • The Regulation of Investigatory Powers Act 2000 ("RIPA") makes it an offence to "intentionally and without lawful authority intercept any communication". However again, particularly in an employment context, no 'interception' per se may have occurred.
  • By contrast, the offence pursuant to s.55 is for simply "obtaining" the data without the data controller's consent – no unauthorised access, interception or even unauthorised use of that data is required.
  • Reporting a case to the ICO pursuant to s.55 is likely to be of low or even no cost to an organisation and the ICO will then decide if and how to pursue the offender. The notification procedure consists of a three-page form that can be found on the ICO website here.
  • Seeking relief in the civil courts, for example for damages and/or to prevent (further) misuse or disclosure of the data, on the other hand, may be more costly. But, if that is a course of action an organisation chooses to take, the criminal conviction may prove useful in those civil proceedings.

Conclusion

In a case of an employee or former employee taking company information which includes personal data, it is worth bearing in mind that s.55 can be a powerful tactical weapon for organisations. Although the fines have historically been at the low end, a criminal conviction in itself is likely to act as a powerful deterrent to most. Further, given a considerable number of large-scale, high value data breaches have occurred recently, together with increased regulation in the form of the GDPR, it may be that pressure will mount to implement custodial sentences, or that the courts will impose higher value fines in the future.

Find a Member

View or print a complete ELA member list »

Client Successes

Altra Industrial Motion Inc.

Altra Industrial Motion Inc. has multiple locations in the U.S., as well as Central America, Europe, and Asia. The Employment Law Alliance has proved to be a great asset in assisting us in dealing with employment issues and matters in such diverse venues as Mexico, Australia, and Spain. We have obtained excellent results using the ELA network for matters ranging from a multi-state review of employment policies to assisting with individual employment issues in a variety of foreign jurisdictions.

In one instance, we were faced with an employment dispute with a former associate in Mexico that had the potential for substantial economic exposure. The matter had been pending for over a year, and we were not confident in the employment advice we had been receiving. I obtained a referral to the ELA counsel in Mexico, who was able to obtain a favorable resolution of the dispute in only a few days. Based on our experiences with the ELA, we would not hesitate to use its many resources for future employment law needs.

American University in Bulgaria

In my career I have been a practicing attorney, counsel to the Governor of Maine, and CEO of a major public utility. I have worked with many lawyers in many settings. When the American University in Bulgaria needed help with employment litigation in federal court in Syracuse, New York, we turned to Pierce Atwood, the ELA member we knew and trusted in Maine, for a referral. We were extremely pleased with the responsiveness and high quality of service we received from Bond Schoeneck & King, the ELA's firm in upstate New York. I would not hesitate to recommend the ELA to any employer.

David T. Flanagan
Member of Board of Trustees 

Arcata Associates

I really enjoyed the Conducting an Effective Internal Investigation in the United States webinar.  We are in the midst of a rather delicate employee relations issue in California right now and the discussion helped me tremendously.  It also reinforced things that you tend to forget if you don't do these investigations frequently.  So, many, many thanks to the Employment Law Alliance for putting that webinar together.  It was extremely beneficial.

Lynn Clayton
Vice President, Human Resources

Barrett Business Services, Inc.

I recently participated in the ELA-sponsored webinar on the Employee Free Choice Act.  I was most impressed with that presentation.  It was extremely helpful and very worthwhile.  I have also been utilizing the ELA's online Global Employer Handbook.  This compliance tool is absolutely terrific. 

I am familiar with several other products that purport to provide up-to- date employment law information and I believe that this resource is superior to other similar compliance manuals.  I am delighted that the ELA provides this free to its members' clients.

Boyd Coffee Company

Employment Law Alliance (ELA) has provided Boyd Coffee Company with a highly valued connection to resources, important information and learning. With complex operations and employees working in approximately 20 states, we are continually striving to keep abreast of specific state laws, many of which vary from state to state. We have participated in the ELA web seminars and have found the content very useful. We appreciate the ease, cost effectiveness and quality of the content and presenters offered by these web seminars.  The Global Employer Handbook has provided our company with a very helpful overview of legal issues in the various states in which we operate, and the network of attorneys has helped us manage issues that have arisen in states other than where our Roastery and corporate headquarters are located in Portland, Oregon.

Capgemini Outsourcing Services GmbH

As an international operating outsourcing and consulting supplier Capgemini has used firms of the Employment Law Alliance in Central Europe. We were always highly satisfied with the quality of employment law advice and the responsiveness. I can really recommend the ELA lawyers.

Hirschfeld Kraemer

Stephen HirschfeldAs an employment lawyer based in San Francisco, I work closely with high tech clients with operations around the globe. Last year, one of my clients needed to implement a workforce reduction in a dozen countries simultaneously. And they gave me 48 hours to accomplish this. I don't know how I could have pulled this off without the resources of the ELA. I don't know of any single law firm that could have made this happen. My client received all of the help they needed in a timely fashion and on a cost effective basis.

Stephen J. Hirschfeld
Partner 

Hollywood Entertainment Corporation

As the Vice President for Litigation & Associate General Counsel for my company, I need to ensure that we have a team of top-notch employment lawyers in place in every jurisdiction where we do business. And I want to be confident that those lawyers know our business so they don't have to reinvent the wheel when a new legal matter arises. With more than 3400 stores and 35,000 employees operating in all 50 U.S. states and across Canada, we rely on the ELA to partner with us to help accomplish our objectives. I have been delighted with the consistent high quality of the work performed by ELA lawyers. I encourage other in-house counsel to use their services, as well.

Ingram Micro

Ingram Micro is the world's largest technology distributor, providing sales, marketing, and logistics services for the IT industry around the globe. With over 13,000 employees working throughout the U.S. and in 35 international countries, we need employment lawyers who we can count on to ensure global legal compliance. Our experience with many multi-state and multi-national law firms is that their employment law services are not always a high priority for them, and many do not have experts in many of their offices. The ELA has assembled an excellent team of highly skilled employment lawyers, wherever and whenever I need them, and they have proven to be an invaluable resource to our company.

Konami Gaming

Our company, Konami Gaming, Inc., is growing rapidly in a very diverse and highly regulated industry. We are aggressively entering new markets outside the domestic U.S., including Canada and South America. I have had the recent opportunity to utilize the services provided by the ELA. The legal advice was both responsive and professional. Most of all, the entire process was seamless since our Nevada attorney coordinated the services and legal advice requested. I look forward to working with the ELA in the future, as it serves as a great resource to the legal community.

Jennifer Martinez
Vice President, Human Resources

Nikkiso Cryo, Inc.

Until recently, I was unaware of the ELA's existence. We have subsidiaries and affiliates throughout the United States, as well as in Asia, the Middle East and Europe. When a recent legal issue arose in Texas, our long-time Nevada counsel, who is a member of the ELA, suggested that this matter be handled by his ELA colleague in Dallas. We are very pleased with the quality and timeliness of services provided by that firm, and we are excited to now have the ELA as an important asset to help us address employment law issues worldwide.

Palm, Inc.

The ELA network has been immensely important to our company in helping us address an array of human resources challenges around the world. I strongly encourage H.R. executives who have employees located in many different jurisdictions to utilize the ELA's unparalleled expertise and geographic coverage.

Stacy Murphy
Former Senior Director of Human Resources

Rich Products

As the General Counsel for a company with 6,500 employees operating across the U.S. and in eight countries, it is critical that I have top quality lawyers on the ground where we do business. The ELA is an indispensable resource. It has taken the guesswork out of finding the best employment counsel wherever we have a problem.

Jill K. Bond
Senior Vice President/General Counsel, Shared Services and Benefits

Ricoh Americas Corporation

We have direct sales and service offices all over the U.S., but have not necessarily had the need in the past for assistance with legal work in every state where we have a business presence. From time to time, we suddenly find ourselves facing a legal issue in a state where we have no outside counsel relationship. It has been a real benefit to know that the ELA has assembled such an impressive team of experts throughout the U.S. and overseas.

A few years ago, we faced a very tough discrimination lawsuit in Mississippi. We had never had to retain a lawyer there before. I was absolutely delighted with the Mississippi ELA firm. We received an excellent result. They will no doubt handle all of our employment law matters in Mississippi in the future. I have also obtained the assistance of several other ELA firms around the U.S. and have received the same outstanding service. The ELA is a tremendous resource for our company.

Roberts-Gordon LLC

Our affiliated companies have used the Employment Law Alliance in connection with numerous acquisitions, and have always been extremely pleased with our ability to obtain the highest quality legal advice on due diligence issues from jurisdiction to jurisdiction. We have found the Employment Law Alliance firms to be not only first rate with respect to their legal advice but also responsive and timely in assisting us with federal and state law issues critical to our due diligence efforts. We consider the Employment Law Alliance to be an important part of our team.

Rockwell Collins, Inc.

We have partnered with many ELA firms on the development and execution of case management strategies with very positive results. We have been very pleased with the legal advice and counsel provided by the law firms we have utilized who are affiliated with the Employment Law Alliance. The ELA firms we have worked with are customer focused, responsive, and thorough in their approach to handling labor and employment law matters.

Elizabeth Daly
Assistant General Counsel

Sanmina-SCI

Sanmina-SCI has facilities strategically located in key regions throughout the world. Our customers expect that we will provide them with the highest quality and most sophisticated services in the marketplace. We have that same expectation for the lawyers with whom we do business. With operations in 17 countries, we need to be certain that we have a team of lawyers working together to address our employment law needs worldwide. The ELA has delivered exactly what it promised-- seamless and consistent high quality services delivered in each locale around the globe. It has quickly become a key asset for our human resources department.

Starwood

We own, manage, and franchise hotels throughout the U.S. and in more than 90 countries. With more than 145,000 employees worldwide, ensuring that we comply with the complex web of local labor and employment laws in every one of these jurisdictions is a daunting task. The Employment Law Alliance has served as an important resource for us and we have benefited greatly from its expertise and long reach. When a legal dispute or issue has arisen in some far-flung place, Employment Law Alliance lawyers have always provided responsive, practical, and cost-effective assistance.

Wilmington Trust Corporation

Wilmington Trust has used the ELA to locate firms in California, Washington State, Georgia, and Europe. Our experience with the ELA lawyers with whom we have worked has always been one of complete satisfaction and prompt, practical advice.

Michael A. DiGregorio
General Counsel