Unlawfully obtaining data under the DPA 1998
Unlawfully obtaining data under the DPA 1998

The following Corporate Crime guidance note provides comprehensive and up to date legal information covering:

  • Unlawfully obtaining data under the DPA 1998
  • Changes as a result of the General Data Protection Regulation
  • The offence of unlawful obtaining of personal data under the DPA 1998
  • Elements of the offence of unlawfully obtaining data
  • Mental elements of the offence of unlawfully obtaining data
  • Corporate liability
  • Statutory defences
  • Sentencing for unlawfully obtaining data
  • Prohibition against requiring the production of information obtained under DPA 1998, s 7

Changes as a result of the General Data Protection Regulation

The General Data Protection Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data is directly applicable and fully enforceable in all EU Member States from 25 May 2018.

The GDPR made substantial amendments to data protection law in the UK. See Practice Notes:

  1. The General Data Protection Regulation (GDPR)

  2. Data protection principles under the GDPR

  3. Sanctions and enforcement under the GDPR

Specific implementing legislation is not required, although the GDPR does allow Member States to introduce further domestic provisions in a number of areas. In the UK, this has been achieved by the Data Protection Act 2018 (DPA 2018). See Practice Note: The Data Protection Act 2018.

The DPA 2018 repealed the Data Protection Act 1998 (DPA 1998) from 25 May 2018 and creates a number of criminal offences relating to the processing and use of personal data in the UK, including an offence of unlawfully obtaining data under the DPA 2018. For information on these offences, all of which can be committed from 25 May 2018, see Practice Note: Offences under the Data Protection Act 2018.

Where a data protection offence occurred before 25 May 2018, it may still be prosecuted under DPA 1998 despite