ICO Prosecution Powers Extension
Leveson Inquiry · An Inquiry into the Culture, Practices and Ethics of the Press · Issued 29 November 2012 · Addressed to: UK Government
Source — verbatim from the inquiry
●Inquiry recommendation
The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
Leveson Inquiry, An Inquiry into the Culture, Practices and Ethics of the Press · 29 Nov 2012 Source PDF →
Published evidence summary
Publicly available evidence relating to this recommendation:
- The Data Protection Act 2018, section 170, provides the ICO with prosecution powers for unlawful obtaining or disclosing of personal data, and section 171 covers re-identification of de-identified data. The ICO may also issue enforcement notices and monetary penalty notices for breaches of data protection principles under Part 6 of the DPA 2018 (Data Protection Act 2018, legislation.gov.uk).
- The ICO's criminal prosecution powers remain limited to specific statutory offences rather than extending to any conduct constituting a breach of data protection principles more broadly. No published evidence that the recommendation was fully implemented has been identified to March 2026.
Response — verbatim from government
●UK Government
The Prime Minister stated on 29 November 2012: "I am instinctively concerned about this proposal. There is a real danger of this recommendation being used to curb freedom of the press. We need to consider this very carefully - particularly the impact this could have on investigative journalism." The Data Protection Act 2018 retained a broad journalism exemption (Schedule 2, Part 5) and did not implement this specific recommendation. Source: https://www.gov.uk/government/speeches/david-cameron-statement-in-response-to-the-leveson-inquiry-report
UK Government · 29 Nov 2012 Written response →
Evidence trail — what's actually happened since
- 27 Feb 2025 · Government / ICO The ICO's prosecution powers were not extended to cover all breaches of data protection principles as Leveson recommended. The ICO has enforcement powers under the DPA 2018 but these are primarily administrative (fines, enforcement notices) rather than the criminal prosecution powers Leveson envisioned. View source → Not Implemented
Each entry above links to a primary source — gov.uk written statement, consultation response document, or inspection report. The Index does not characterise government intent; it tracks what has been published.
How this page is built
Source and Response are verbatim from primary documents. The Evidence trail records published activity since — written statements, consultation outcomes, inspection findings, parliamentary references. The Index does not paraphrase or characterise intent; it tracks what has been published. Where the evidence is the absence of action (a missed deadline, a slipped timetable), that absence is documented from primary sources rather than inferred.
This recommendation's data is verified periodically against primary sources. The Index is monitored for staleness weekly.