22.—(1) A person who—

(a) obtains access to personal data, or obtains any information constituting such data, without the prior authority of the data controller or data processor by whom the data are kept, and

(b) discloses the data or information to another person,

shall be guilty of an offence.

(2) Subsection (1) of this section does not apply to a person who is an employee or agent of the data controller or data processor concerned.