Bring into Force Section 55 Penalties
Leveson Inquiry · An Inquiry into the Culture, Practices and Ethics of the Press · Issued 29 November 2012 · Addressed to: UK Government
Source — verbatim from the inquiry
●Inquiry recommendation
The necessary steps should be taken to bring into force the amendments made to section 55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism).
Leveson Inquiry, An Inquiry into the Culture, Practices and Ethics of the Press · 29 Nov 2012 Source PDF →
Published evidence summary
Publicly available evidence relating to this recommendation:
- Section 55 of the DPA 1998 was replaced by section 170 of the Data Protection Act 2018, which makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller (Data Protection Act 2018, Section 170, legislation.gov.uk).
- Under section 196 of the DPA 2018, the maximum penalty for a section 170 offence is a fine on conviction on indictment, with no custodial sentence available (Data Protection Act 2018, Section 196, legislation.gov.uk).
- The recommendation that custodial sentences should be available for unlawful obtaining of personal data has not been implemented. No published government explanation for this decision has been identified to March 2026.
Response — verbatim from government
●UK Government
The Prime Minister stated on 29 November 2012: "I am instinctively concerned about this proposal. There is a real danger of this recommendation being used to curb freedom of the press. We need to consider this very carefully - particularly the impact this could have on investigative journalism." The Data Protection Act 2018 retained a broad journalism exemption (Schedule 2, Part 5) and did not implement this specific recommendation. Source: https://www.gov.uk/government/speeches/david-cameron-statement-in-response-to-the-leveson-inquiry-report
UK Government · 29 Nov 2012 Written response →
Evidence trail — what's actually happened since
- 27 Feb 2025 · UK Parliament The increased sentencing powers for section 55 breaches (unlawfully obtaining personal data) under sections 77-78 of the Criminal Justice and Immigration Act 2008 were never brought into force. The DPA 2018 created new offences but the specific provisions Leveson referenced were not commenced. View source → Not Implemented
Each entry above links to a primary source — gov.uk written statement, consultation response document, or inspection report. The Index does not characterise government intent; it tracks what has been published.
How this page is built
Source and Response are verbatim from primary documents. The Evidence trail records published activity since — written statements, consultation outcomes, inspection findings, parliamentary references. The Index does not paraphrase or characterise intent; it tracks what has been published. Where the evidence is the absence of action (a missed deadline, a slipped timetable), that absence is documented from primary sources rather than inferred.
This recommendation's data is verified periodically against primary sources. The Index is monitored for staleness weekly.