The Criminal Justice and Immigration Act: changes to the law on data protection, blasphemy and pornography


In May 2008, the Criminal Justice and Immigration Act came into force in the UK. This legislation changes a number of different areas of the law. In this article we focus on three areas of change; the changes to Data Protection rules, the abolition of blasphemy and the introduction of the offence of possessing extreme pornography.


The Criminal Justice and Immigration Act 2008 received Royal Assent on 8 May 2008. This Act includes a number of significant amendments to UK legislation. Significantly the Act abolishes the offence of blasphemy in the UK, grants new powers to the Information Commissioner in the field of data protection law, and creates a new offence of possessing extreme pornography.

Changes to data protection enforcement rules

In the past, the Information Commissioner’s Office’s (the UK Data Protection Regulator) enforcement powers have been limited. However, the Criminal Justice and Immigration Act has given the Information Commissioner’s Office power to levy fines for data protection breaches, and new criminal offences have been introduced.

The Information Commissioner has been given powers to fine for "serious" breaches of the Data Protection Act 1998. Fines can be levied where there have been deliberate breaches of the Act and where the Commissioner thinks that this kind of breach is likely to cause substantial damage or distress. Fines can also be levied for this kind of serious breach if the data controller “knew, or ought to have known” that there was a risk of a serious breach which would be likely to cause substantial damage or distress, and failed to take reasonable steps to prevent this.

The precise arrangements relating to the fines are to be set out in secondary legislation, which will prescribe the maximum amount of the fine which can be levied and the arrangements for appealing fines to the Information Tribunal. The Information Commissioner is also obliged to issue guidance explaining when fines could be imposed and the likely scale of fines.

There are also enhanced penalties for unlawfully obtaining/disclosure of personal data - i.e. blagging, or pretexting. This will be via secondary legislation which will introduce custodial sentences for these offences for up to 12 months (for magistrates’ court convictions) or 2 years (for convictions on indictment). A new defence to S.55 has been added, which applies where there was a reasonable belief that the obtaining or disclosure was in the public interest and where there is a view to publication of journalistic, literary or artistic material.

The defence relating to the publication of journalistic, literary or artistic material is not yet in force. The provisions relating to the blagging offence rely on secondary legislation to bring them into force. There is, as yet, no indication as to when the provisions will be brought into force or when the secondary legislation will be promulgated.

Blasphemy law abolished

The UK common law recognised the offences of blasphemy and blasphemous libel. However, this archaic law was very limited in scope. Blasphemy offences only applied to attacks on God, Jesus Christ, the Bible or the formularies of the Church of England. It did not apply to attacks on any other religion. The Criminal Justice and Immigration Act has abolished these common law offences. This issue has been subject to much debate in the UK, with supporters of the abolition arguing that religious freedoms are sufficiently protected under UK legislation, and that this archaic law is no longer compatible with the Human Rights Act. If follows on from the introduction of offences of inciting religious hatred in the Racial and Religious Hatred Act 2006.

The new offence of possessing “extreme pornography”

The Act has introduced a new pornography offence of possessing extreme pornography. In the past, the focus of UK obscenity legislation has been on offences relating to publishing matters likely to “deprave and corrupt” those likely to read, see or hear the matter contained within it. The focus was on criminalising the publication of such material. Mere possession, unless for commercial purposes or child pornography, is not an offence. The new legislation has introduced offences of mere possession of extreme pornography.

The Act defines both pornography (an image which is “of such a nature that it must reasonably be assumed to have been produced solely or principally for the purpose of sexual arousal”) and extreme pornography. Although the definition of extreme pornography still requires the images to be grossly offensive, disgusting or otherwise of an obscene character, the Act gives objective examples of the type of images and activities that would fall under the definition of extreme pornography.

The penalty for possessing extreme pornographic images depends upon the act portrayed. Depictions of acts which threaten a person’s life or an act which results, or is likely to result, in serious injury to a person’s anus, breasts or genitals can result in a maximum of 3 years imprisonment. For other offences, the maximum penalty is 2 years imprisonment. Where an offender is sentenced to a sentence of longer than 2 years they will also be placed on the Violent and Sex Offender Register.

Sex offender monitoring provisions

The Act also introduces a provision which enables the Secretary of State, through secondary legislation under the Sexual Offences Act to require those convicted or cautioned of relevant sexual offences to notify their email addresses to the police. It is thought that this will reduce further offences taking place because the police will liaise with the operators of social-networking sites to ensure that offenders stop using these sites.

The position of ISPs under the new rules on extreme pornography

The Act also provides special rules for ISPs. These rules are intended to ensure that the protections for ISPs under the E-Commerce Directive still apply. Therefore ISPs can still rely on the exceptions (mere conduit exception, exceptions for caching, exception for hosting) set out under the E-Commerce Regulations. The Act also distinguishes between UK service providers and non-UK (but established in the EEA) service providers. The Act applies to UK-based ISPs, wherever they provide services in the EEA. It states that proceedings may only be brought against a non-UK based ISP if it is:

  • necessary for the purposes of the public-interest objective; and

  • relates to an information-society service that prejudices or presents a serious and grave risk to that objective; and is proportionate to that objective.
These provisions reflect the country of origin provisions of the E-Commerce Directive.