Data Protection Act 2018, section 170

Unlawful obtaining etc of personal data

PART 6 Enforcement

(1)It is an offence for a person knowingly or recklessly—

(a)to obtain or disclose personal data without the consent of the controller,

(b)to procure the disclosure of personal data to another person without the consent of the controller, or

(c)after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.

(2)It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—

(a)was necessary for the purposes of preventing [F720, investigatingF720] or detecting crime,

(b)was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(c)in the particular circumstances, was justified as being in the public interest.

(3)It is also a defence for a person charged with an offence under subsection (1) to prove that—

(a)the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,

(b)the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or

(c)the person acted—

(i)for the special purposes,

(ii)with a view to the publication by a person of any journalistic, academic, artistic or literary material, and

(iii)in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.

(4)It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.

(5)It is an offence for a person to offer to sell personal data if the person—

(a)has obtained the data in circumstances in which an offence under subsection (1) was committed, or

(b)subsequently obtains the data in such circumstances.

(6)For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.

(7)In this section—

(a)references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the [F721UK GDPRF721] or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);

(b)where there is more than one controller, such references are references to the consent of one or more of them.

Definitions used in section 170 4

enactment

“enactment” includes—

(a)

an enactment passed or made after this Act,

(b)

an enactment comprised in subordinate legislation,

(c)

an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,

(d)

an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...

(e)

an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and

(f)

any assimilated direct legislation;

Defined in s.205(1) · see it in the full Act
tribunal

“tribunal” means any tribunal in which legal proceedings may be brought;

Defined in s.205(1) · see it in the full Act
the Tribunal

“the Tribunal”, in relation to an application or appeal under this Act, means—

(a)

the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, or

(b)

the First-tier Tribunal, in any other case.

Defined in s.205(1) · see it in the full Act
the special purposes

(1) In this Part, “the special purposes” means one or more of the following—

(a)the purposes of journalism;

(b)academic purposes;

(c)artistic purposes;

(d)literary purposes.

Defined in s.174(1) · see it in the full Act

Cases considering section 170 7

Shepherd v The Information Commissioner

[2019] EWCA Crim 2 · 18 January 2019Interprets

The court treated the new section’s structure and express formulation of a defence to be proved as materially different from section 55 of the earlier Act (see paras [53]-[55]). Section 170(2), expressly framed as a defence to be proved by a person charged, imposes a legal burden on the defendant. The court expressed no view on its compatibility with article 6 rights (see paras [53]-[55]).

Heather Peto v The Information Commissioner

[2025] EWHC 146 (Admin) · 29 January 2025Limits

The court treated section 170 as a complex, fact- and context-sensitive offence provision. Whether conduct constitutes an offence, and whether a defence applies, depends on the circumstances existing when the conduct occurs. The provision therefore could not support a definitive advance ruling on hypothetical conduct (see paras [19]-[21]). The court referred to the fact-sensitive question whether obtaining or disclosing personal data without the controller’s consent might constitute an offence under section 170(1). That question could not be determined without knowing the future conduct and surrounding circumstances (see paras [10]-[11], [19], [21]). The claimant relied on the statutory defences in section 170(2). The court held that the possible application of the defences was itself fact-sensitive and could not be resolved in advance of the proposed conduct (see paras [11], [19]). The claimant relied on the additional defences under section 170(3). The judgment treated their availability as dependent on the particular circumstances and therefore unsuitable for definitive determination in a hypothetical case (see paras [11], [19]).

Ken Bates v Tom Rubython & Anor

[2024] EWHC 2706 (KB) · 25 October 2024Limits

Confirms that the defendants’ reliance on section 170(1) did not justify refusing to disclose the subscriber list ordered by the court. The provision was treated as irrelevant to compliance with the disclosure order. (see paras [55]-[60]) Confirms that disclosure ordered by a court was within the statutory defence relied on by the claimant. The defendants’ continuing refusal to disclose the subscriber list was therefore culpable and supported an adverse inference. (see paras [56]-[60]; [93])

What each judgment says about section 170 is in the case-law panel in the full Act.

Amendments and notes

3 notes from legislation.gov.uk

Amendments

  1. F720Word in s. 170(2)(a) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 22; S.I. 2026/82, reg. 2(z12)
  2. F721Words in s. 170(7) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 71 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I177S. 170 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)