Bidda Sovereign Intelligence · 10,099 Verified Nodes · 39 Sovereign Pillars

UK Data Protection Act 2018 Section 170 - Unlawful Obtaining etc of Personal Data (Without Controller Consent, Knowingly or Recklessly, Selling and Offering to Sell)

Section 170 of the Data Protection Act 2018 (c. 12) creates the UK criminal offence of unlawful obtaining, disclosure, procurement, or retention of…

What UK Data Protection Act 2018 Section 170 - Unlawful Obtaining etc of Personal Data (Without Controller Consent, Knowingly or Recklessly, Selling and Offering to Sell) requires

Section 170 of the Data Protection Act 2018 (c. 12) creates the UK criminal offence of unlawful obtaining, disclosure, procurement, or retention of personal data without the consent of the controller, replacing the previous offence in section 55 of the Data Protection Act 1998. Section 170 operates as a criminal-law sister offence to the civil UK GDPR / DPA 2018 enforcement regime administered by the Information Commissioner's Office (ICO) and is the operative offence in prosecutions of insider data theft, blagging (social-engineering of personal data from third parties), commercial data brokering of personal data obtained without lawful basis, and unauthorised retention of personal data after employment ends. Under section 170(1), it is an offence for a person knowingly or recklessly (a) to obtain or disclose personal data without the consent of the controller, (b) to procure the disclosure of personal data to another person without the consent of the controller, or (c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained. Under section 170(2), defences require the defendant to prove the conduct (a) was necessary for the purposes of preventing, investigating or detecting crime, (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or (c) in the particular circumstances, was justified as being in the public interest. Under section 170(3), additional defences cover reasonable belief in a legal right to obtain, belief that the controller would have consented, and journalistic, academic, artistic or literary purposes justified as being in the public interest. Under section 170(4) and (5), it is a further offence to sell or offer to sell personal data obtained in contravention of subsection (1). The penalty under section 196 is an unlimited fine on summary conviction (E&W) or indictment - this is the only summary-or-either-way DPA criminal offence and a 2017 amendment in the Voyeurism (Offences) Act series consultation strengthened the offences, though no custodial penalty was added. Section 170 prosecutions are typically brought by the ICO in England and Wales and by the Crown Office in Scotland.

Pillar: Data Protection & Privacy · Authority: Parliament of the United Kingdom · Version: 1.0.0 · Last updated:

Primary source: https://www.legislation.gov.uk/ukpga/2018/12/section/170

SHA-256 integrity: 56927b50350aecbf47fdd5f22f2fc91d569ea593bd8e2b8c8821e92cd399e992

Primary Citations — 8 traced to source

  • Data Protection Act 2018 (c. 12) Section 170 (Unlawful obtaining etc of personal data) subsection (1): 'It is an offence for a person knowingly or recklessly (a) to obtain or disclose personal data without the consent of the controller, (b) to procure the disclosure of personal data to another person without the consent of the controller, or (c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.' Published at legislation.gov.uk/ukpga/2018/12/section/170.
  • Data Protection Act 2018 section 170(2): defences requiring the defendant to prove the conduct (a) was necessary for the purposes of preventing, investigating or detecting crime; (b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal; or (c) in the particular circumstances, was justified as being in the public interest.

+ 6 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

⚠ Important: Human Verification Required

Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.