Data Protection Act 1988

Disclosure of personal data obtained without authority.

22

22. (1) A person who—

( a) obtains access to personal data, or obtains any information constituting such data, without the prior authority of the data controller or data processor by whom the data are kept, and

( b) discloses the data or information to another person,

shall be guilty of an offence.

(2) Subsection (1) of this section does not apply to a person who is an employee or agent of the data controller or data processor concerned.