If Staff Snoop Without You Knowing, Who Is Liable Under DPA s.170?

Yes, an employee can commit a criminal offence under section 170 of the Data Protection Act 2018 without anyone above them knowing. In fact, your not knowing is close to the point. The offence turns on the controller not having consented.

The harder question is what that leaves you holding. The person who did it is exposed, but so, separately, are you. This post is about that second half, from the employer's side of the desk.

The offence needs your lack of consent

Section 170(1) makes it an offence for a person knowingly or recklessly, without the consent of the controller, to do any of these:

• obtain or disclose personal data;
• procure the disclosure of personal data to another person;
• retain personal data after obtaining it, without the consent of whoever was the controller at the time.

The "controller" is your organisation, not your line manager. A member of staff who pulls up a neighbour's record out of curiosity has not been authorised by the organisation to do that, whatever their login permits. Nobody needing to have noticed is exactly how most of these cases look.

Selling the data, or offering to, is a further offence under the same section (subsections 4 and 5). That matters for the classic pattern of staff passing records to claims firms or private investigators.

What the employee can argue

Section 170(2) gives defences, and they are narrower than people hope. In outline, the person must show one of these:

• the obtaining, disclosing or retaining was necessary for preventing or detecting crime;
• it was required or authorised by law, or by a court order;
• they acted in the reasonable belief that they had a legal right to do it;
• they acted in the reasonable belief that the controller would have consented had it known;
• it was justified as being in the public interest.

"I assumed you would not mind" only helps if that belief was reasonable. A clerk reading an ex-partner's file is unlikely to get far with it. Read the section itself for the exact wording; I have paraphrased.

Prosecution is by the ICO, and the penalty is a fine

Under section 197, proceedings need to be brought by the Information Commissioner or with the consent of the Director of Public Prosecutions. Under section 196 the penalty is a fine only. There is no prison sentence for the section 170 offence itself, though the same conduct can also be caught by other law, such as the Computer Misuse Act 1990 or misconduct in public office, which do carry custody.

A conviction is also a criminal record for the individual, and that tends to bite harder than the fine does.

Does the employer get prosecuted too?

Not automatically. Section 170 targets the individual who did the obtaining. Your organisation is only in the frame for this offence if it was itself the one acting, which is the opposite of the scenario here.

There is one exception worth knowing. Under section 198, where a body corporate commits an offence with the consent or connivance of, or through the neglect of, a director, manager, secretary or similar officer, that person can be prosecuted as well. That is about the company's offence, so it needs the company to have offended. Ignoring a known problem is the sort of thing it was written for.

Quick detour: why is the company not vicariously liable?

Hang on, surely an employer answers for its staff? Often yes, but not here. In WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12, the Supreme Court held that Morrisons was not vicariously liable when a disgruntled employee leaked colleagues' payroll data online, because the employee was pursuing a personal vendetta rather than acting in the course of their employment.

That is a court decision on a particular set of facts, not a blanket rule. The Court also accepted that the Data Protection Act 1998 did not exclude vicarious liability in principle. A member of staff doing something close to their job, just badly or dishonestly, is a different case from one pursuing a private grudge.

The exposure you do carry is your own security duty

Even if you are never vicariously liable, UK GDPR can still bite directly. These duties belong to the controller:

• Article 5(1)(f): personal data must be processed securely, including protection against unauthorised processing.
• Article 32: appropriate technical and organisational measures, which the ICO reads as including access control and monitoring.
• Article 33: notify the ICO of a reportable breach within 72 hours of becoming aware of it, unless it is unlikely to result in risk to individuals.

So an employee's offence can become your regulatory problem if the investigation shows that anyone could browse any record with no logging and no review. That is my reading, not a rule that every snooping incident leads to a fine. The ICO weighs the circumstances.

Notice what "becoming aware" does to the clock. Not looking is not a defence you can lean on. If your systems log access and nobody reads the logs, a regulator may reasonably ask why.

What this means for a technical team

Practical steps follow from the above, and they are mostly engineering:

1. Log reads of personal records, not just writes, with the user, record and time.
2. Alert on patterns such as lookups of records with no open case, or of staff members' own relatives and colleagues.
3. Restrict access by role and need, so the blast radius of one curious person is small.
4. Tell staff plainly that accessing data without a work reason may be a criminal offence. This also supports the argument that you never consented.
5. Have a route from an alert to an investigation, and from there to a breach decision and, where relevant, a referral.

Monitoring staff is itself processing of their personal data, so it needs a lawful basis and proportionality, and staff should be told about it. Whether a given scheme is lawful depends on how it is built, and I have not tried to settle that here.

The oddly comforting part is that logging does double duty: it deters, and it is what lets you say "we found it and acted" instead of "we had no idea".