Criminal Justice and Immigration Act 2008

77 Power to alter penalty for unlawfully obtaining etc. personal data U.K.

(1) The Secretary of State may by order provide for a person who is guilty of an offence under section 55 of the Data Protection Act 1998 (c. 29) (unlawful obtaining etc. of personal data) to be liable—

(a) on summary conviction, to imprisonment for a term not exceeding the specified period or to a fine not exceeding the statutory maximum or to both,

(b) on conviction on indictment, to imprisonment for a term not exceeding the specified period or to a fine or to both.

(2) In subsection (1)(a) and (b) “specified period” means a period provided for by the order but the period must not exceed—

(a) in the case of summary conviction, 12 months (or, in Northern Ireland, 6 months), and

(b) in the case of conviction on indictment, two years.

(3) The Secretary of State must ensure that any specified period for England and Wales which, in the case of summary conviction, exceeds 6 months is to be read as a reference to 6 months so far as it relates to an offence committed before the commencement of section 282(1) of the Criminal Justice Act 2003 (c. 44) (increase in sentencing powers of magistrates' courts from 6 to 12 months for certain offences triable either way).

(4) Before making an order under this section, the Secretary of State must consult—

(a) the Information Commissioner,

(b) such media organisations as the Secretary of State considers appropriate, and

(c) such other persons as the Secretary of State considers appropriate.

(5) An order under this section may, in particular, amend the Data Protection Act 1998.