How a data protection breach can result in criminal prosecution

Fri 13th Jan 2017

In the lead up to the introduction of new data protection laws in 2018, businesses are increasingly aware of the complex issues around sharing data. Philip Sayers, Employment lawyer at Coodes Solicitors, comments on how this can extend from corporate to personal liability.

“Clients and customers are absolutely crucial to businesses. Of course they could also be of great interest to your competitors. In a recent case, an employee from a car lease business sold the personal records of customers who had been involved in road traffic accidents to another business, as personal injury leads. The employee was prosecuted for committing two criminal offences: unlawfully obtaining personal data and unlawfully selling personal data. He pleaded guilty to both and was fined.

“This was quite an extreme case, but it does demonstrate the potential for data protection to become a criminal issue. Businesses should be aware that breaches of data protection can be criminal and regulatory offences. It is important for employers also to be aware that there are personal, as well as corporate, liability issues.

“Businesses need to understand that data protection breaches are potentially criminal offences. This recent case shows how a breach can be a personal – as well as a corporate – liability. This extends to incidents that may not seem to be as serious and shocking as the recent case highlighted here. In fact, if a former employee still holds client or customer contact details this can be a breach. It can also be a breach if work contact details are held on a personal device if others can access it.

“Many employees believe that data protection is their employer’s responsibility. In fact, as this case highlights, staff can be held personally accountable for data protection breaches. It is therefore very important for businesses to make this clear in a robust data protection policy. If things do go wrong, you will also need to be able to demonstrate that you had given data protection training to the employee in question.”

For more information on this or any Employment enquiries contact Philip Sayers, Employment team, Coodes Solicitors on 01872 246200 or

Fri 13th Jan 2017

Related Services & sectors

Get in touch

Call us on 0800 328 3282, or complete the form below and we’ll get back to you as soon as possible.

This field is for validation purposes and should be left unchanged.

Search News & Events



Changes to Paternity Leave in April 2024: What do you need to know?

As of 6th April 2024, paternity leave will be changing to reflect a shifting attitude…

Read more


Suspecting a Power of Attorney of financial abuse: what can you do?

What steps should you take if you suspect someone is committing financial abuse as a…

Read more

Portfolio Builder

Select the legal expertise that you would like to download or add to the portfolio

    Download    Add to portfolio   

    Remove All


    Click here to share this shortlist.
    (It will expire after 30 days.)