The Law Commission and the protection of official data

I spent three of the happiest years of my working life just over 20 years ago as Chairman of the Law Commission.   One of the aims I set myself during my time in office was to make the quality and significance of the Commission’s work much more widely known, and I have been delighted by the way in which ever since then the Commission’s reputation for rigorous, totally independent, fact-based research and analysis of the defects of contemporary law has steadily burgeoned year by year.

From its very beginnings in Lord Scarman’s days 50 years ago the Commission developed its practice of dividing each of its law reform projects into three stages:

First, a dispassionate analysis of the deficiencies of the existing law, culminating in the publication of a consultation paper.

Next, a period set for genuine consultation, sometimes supported by consultative seminars, and followed by a very thorough analysis of the responses to consultation, leading on to Commissioners deciding on the policy to adopt for their final report.

And finally, the preparation of the final report, often (but not always) accompanied by a draft Bill prepared by Parliamentary Counsel, which puts into effect the Commission’s policy choices.

A typical law reform project used to last for three years, with one year being devoted to each stage of the process, although the Commission was able to accelerate, usually at the express request of Government, when the situation demanded a speedier response.

The Commission’s techniques have now been widely adopted within Government, although sadly all too often ministers appear to have decided on their policies at the outset, to pay lip service to the need for consultation, and to run fairly roughshod over many of the responses they receive.

Not so the Law Commission.  I remember that when we held a press conference to launch the Commission’s major proposals for the reform of mental capacity law, there were a lot of favourable comments about the extent to which the Commission had genuinely been taking on board many of the contributions its consultation papers had elicited in the course of that massive project.

Those of us who value the quality of the work of the Law Commission will have therefore been troubled by the frontal assault that was mounted on it last week by certain sections of the media (and by others, such as Liberty), arising out of a few passages in the long and scholarly 320-page Consultation Paper on Protection of Official Data which it published at the beginning of this month.

The background to this brouhaha was that in late 2015 the Commission was invited by the Cabinet Office to undertake a major review of the effectiveness of provisions of the criminal law concerned with this difficult topic. It has described the project in these terms:

1.5 The Protection of Official Data project was referred to us by the Cabinet Office in late 2015. We commenced work on the project in February 2016 and plan to publish our final report in Spring 2017.

1.6 We agreed the following terms of reference with the Cabinet Office:

(1) The Review will examine the effectiveness of the criminal law provisions that protect Government information from unauthorised disclosure. The Review will assess any deficiencies in the law, and research options for improving the protection of official information with the aim of providing an effective and coherent legal response to unauthorised disclosures. The Review will also examine provisions that criminalise those who illegitimately obtain or attempt to obtain official information.

(2) The review will include, but will not be limited to, the Official Secrets Acts 1911, 1920 and 1989. It will want to consider other criminal provisions that protect information held by Government from unauthorised disclosure and to take into account relevant aspects of the Data Protection Act 1998, the Public Interest Disclosure Act 1998 and the protections for information exempt from release under the Freedom of Information Act 2000. The Review will take a holistic approach and examine how the legislative landscape could be rationalised and made more coherent.

(3) The Review will also consider:

(a) the relationship between the legislative regime and internal disciplinary measures to which public servants and others are subject;

(b) the powers available to investigators;

(c) the relationship between the criminal law and any civil remedies;

(d) the effect of technological change on the way in which data is stored, shared and understood, and determine whether the current law needs to be reformed properly to account for these changes.

It will be seen that the Commission had originally hoped that it would be able to complete its report in the “spring of 2017.”  It commenced its work, as is normal, by having preliminary discussions with a number of Governmental and non-Governmental organisations which it believed could give it useful information about different aspects of the project, and it has said it had hoped to resume some of those discussions last summer. Unfortunately, as sometimes occurs with Law Commission projects, it very soon perceived the scale to which relevant legislation on interlocking topics had grown up haphazardly like Topsy over the years, and that it could not possibly do full justice to the topics it had been asked to address without very much deeper and lengthier research than it had previously contemplated.

This led to the consequence that this massive consultation paper was not ready for publication until the beginning of this month, and also to the unfortunate consequence that the Commission felt constrained, no doubt by the pressures of the timetable it had originally agreed, to limit the consultation period to two months instead of the three months (including at least one legal vacation) which it was customary in my time for the Commission to set for all its projects, however small.

It is greatly to be hoped that in view of the massive adverse publicity this consultation paper has provoked, the Commission can be persuaded to extend the consultation period by another month.

At an early stage of the storm the Commission published an explanatory notice, largely ignored by its critics (who included the authors of leading articles in national newspapers), in which it sought to distinguish between “myth” and “fact”:

Myth: Unauthorised disclosure to journalists to be made criminal.

Fact: They already are criminal under the 1989 Act.

Myth: There was no consultation before these recommendations were made.

Fact: These are provisional proposals. Consultation was launched on 2nd February 2017.

Myth: The Law Commission recommends sentences of 14 years.

Fact: No recommendations as to sentence are made: we do not even make a proposal.

Myth: The Law Commission is threatening open justice.

Fact: We propose narrowing the circumstances in which sensitive information might be withheld from public trial.

Myth: Whistle-blowing is to be made an offence.

Fact: The Official Secrets Act already criminalises making unauthorised disclosure of certain types of sensitive information.

Myth: The Law Commission will extend the offences to “anyone” including journalists.

Fact: The offences contained in the 1911 Act can already be committed by anyone including journalists.

Just to illustrate the unfairness of the criticism that has engendered the greatest journalistic spleen, here is the passage in the Consultation Paper which attracted hostile attention. It is a section in which the Commission seeks people’s views about the adequacy of some of the sentences contained in the Official Secrets Act 1989, with a view to achieving greater consistency overall.


3.180 The majority of the offences in the Official Secrets Act 1989 are triable either in a magistrates’ court or in the Crown Court. The maximum sentence for the majority of the offences is six months’ imprisonment and/or a fine if tried in a magistrates’ court and two years’ imprisonment and/or a fine if tried in the Crown Court. The offence in sections 8(1), 8(4) and 8(5) is triable only in a magistrates’ court and carries a maximum sentence of three months’ imprisonment.

3.181 As we explained above, the unauthorised disclosure offences in the Official Secrets Acts have carried a maximum sentence of two years’ imprisonment for many years. In the White Paper that preceded the 1989 Act, the Government did not engage substantively with whether these sentences are appropriate. In addition the Franks Committee, when it conducted its review of section 2 of the Official Secrets Act 1911, did not receive any evidence on the whether the two year maximum sentence was appropriate.

3.182 More recently, however, the Intelligence and Security Committee of Parliament has commented that:

“There are startlingly inconsistent sentences for broadly similar offences, while the existing legislation fails to distinguish between offences which vary considerably in the seriousness of their consequences. Offences under the 1911 Act carry a penalty of up to 14 years’ imprisonment. Offences under the 1989 Act carry sentences no higher than two years’ imprisonment.

Disclosing the names of agents, and thus endangering their lives, may require a substantially higher penalty than is currently available under the 1989 Act. Consideration should therefore be given to the introduction of a more gradual series of penalties.”[1]

3.183 As we discuss in Chapter 4, our research has demonstrated the existence of numerous offences that criminalise the unauthorised disclosure of various categories of information. The vast majority of these offences carry maximum sentences of two years’ imprisonment if tried in a Crown Court. There are others, however, that carry a higher maximum sentence.

3.184 The maximum sentence for the offences contained in the Official Secrets Act 1989 is the same as many other offences that criminalise the unauthorised disclosure of information. For example, it is an offence punishable by up to two years’ imprisonment for an employee of the National Lottery Commission to disclose information that has been supplied by Her Majesty’s Commissioners for Revenue and Customs that relates to a person whose identity is specified in the information or whose identity can be deduced from the information. This is the same maximum sentence available for an unauthorised disclosure that, to take one example, damages the capability of the armed forces to carry out their tasks.

3.185 By way of contrast, sections 57 – 59 of the Investigatory Powers Act 2016, when commenced, will make it an offence punishable by up to five years’ imprisonment for a Crown servant to disclose without authorisation anything to do with the existence or implementation of particular warrants granted pursuant to the Investigatory Powers Act, including the content of intercepted material and related communications data. Appendix C sets out a list of other disclosure offences that our research has brought to light.

3.186 When compared with these wider disclosure offences, it could be argued that the maximum sentence available for the offences in the Official Secrets Act 1989 does not adequately reflect the culpability in the most egregious cases involving unauthorised disclosure of information that causes damage to the interests listed in the 1989 Act.

3.187 Additionally, the maximum sentence for the offences in the Official Secrets Act 1989 is low when compared with offences that exist in other jurisdictions that criminalise similar forms of wrongdoing, as suggested by our comparative law research in Appendix A. For example, the maximum sentence for making an unauthorised disclosure in Canadian law under the Security of Information Act 2001 is 14 years’ imprisonment.[2]

3.188 In the digital age, the volume of information that can be disclosed without authorisation is much greater than when the Official Secrets Act 1989 was originally drafted. It could be argued that this means that the ability to cause damage to the national interest and the risk of such damage occurring has also increased. It could be argued that there is also a corresponding increase in culpability in such cases. Provisional conclusion

13 3.189 We provisionally conclude that the maximum sentences currently available for the offences contained in the Official Secrets Act 1989 are not capable of reflecting the potential harm and culpability that may arise in a serious case. Do consultees agree?

It would be nice to think that when the dust settles the Commission’s critics will also settle down to prepare responses to the consultation of the quality that a thoughtful paper of this outstanding quality deserves.  They can be confident that Commissioners (headed by Lord Justice Bean, and including Professor David Ormerod QC , the Criminal Law Commissioner, who has been winning golden opinions for the quality and thoroughness of the work of the team he leads) will consider them very carefully before they lay their final report before Parliament.

The ball will then be passed to Parliament and to the Government to make what they wish of the Commission’s findings and recommendations.


[1] Intelligence and Security Committee, 2003-2004 Annual Report (June 2004) Cm 6240, p 43. The Committee as currently constituted has expressed no view on the Official Secrets Acts 1911-1989.

[2] Security of Information Act 2001, s 14(2).


3 thoughts on “The Law Commission and the protection of official data

  1. Thank you for the above. I also hope that the consultation period be extended to 3 months in total. It isn’t much of a delay. There seems to be a sensible case for looking at the maximum available sentences. In fairness, the 14 years is mentioned in relation to Canadian legislation. When a range of sentences is arrived at, there should be follow up by the Sentencing Council with suitable guidelines.


  2. Pingback: Law and Media Round Up – 20 February 2017 | Inforrm's Blog

  3. Pingback: Law Commission lambasted over espionage law proposals - Legal Cheek

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s