Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, if she will make an assessment of the potential merits of making breaches of an individual's data a criminal offence.

The Government takes both the protection of personal data and the right to privacy extremely seriously. Individuals and organisations responsible for some of the most serious data breaches are already liable to criminal prosecution under the Data Protection Act 2018. For example, people can be prosecuted if they unlawfully obtain, disclose or retain personal data; re-identify personal data that has been pseudonymised without lawful basis; or deliberately frustrate investigations by the Information Commissioner. Where criminal penalties are not available, the Commissioner can impose significant administrative penalties, including fines of up to 4% of global turnover or £18 million, whichever is higher.

The Government worked closely with the Information Commissioner throughout the passage of Data Protection Bill to strengthen and modernise our legislation. We will continue to work closely with the Information Commissioner’s Office (ICO) to ensure her enforcement powers remain fit for purpose to deal with increasingly complex investigations in our digital economy and society.