Data Protection Act 1988
Disclosure of personal data obtained without authority.
22.— (1) A person who—
( a) obtains access to personal data, or obtains any information constituting such data, without the prior authority of the data controller or data processor by whom the data are kept, and
( b) discloses the data or information to another person,
shall be guilty of an offence.
(2) Subsection (1) of this section does not apply to a person who is an employee or agent of the data controller or data processor concerned.