The U.K. Information Commissioner’s Office, the U.K.’s independent body for the upholding of information rights in the public interest, has issued a consultation paper on proposals that it be granted investigative and other powers under the Proceeds of Crime Act 2002. The proposals are in response to the increasing number of cases in which financial gains are made by criminals involved in the theft of personal data. Often, the penalties available to prosecutors under the General Data Protection Regulation and the U.K. Data Protection Act 2018 are insufficient to strip criminals of the proceeds of their crimes, meaning there is an inadequate disincentive to carry out data theft. There is also an incongruence between the deterrents for criminal offences and the high civil penalties for breach of GDPR. Under POCA, the courts are entitled to confiscate an amount equivalent to the value of a crime from a convicted individual. The ICO previously worked together with other agencies to conduct financial investigations and assist the courts in such cases, but the partner agencies are no longer able to provide assistance. The ICO is therefore proposing that it be granted the following POCA powers to enable it to continue to conduct relevant investigations and impose adequate penalties on those profiting from data theft:

• The ability to apply to the court for Restraint and Confiscation Orders;
• Cash seizure, detention and forfeiture from premises;
• Asset seizure and forfeiture from premises;
• The ability to undertake investigations; and
• Access to information relevant to the investigation of money laundering offences.

Responses to the consultation should be sent by December 6, 2019.

View the ICO's consultation paper. 

[View source.]