Part 6: Enforcement Section 170: Unlawful obtaining etc of personal data
This section criminalises the deliberate or reckless obtaining, disclosing, procuring disclosure to another and retention of personal data without the consent of the data controller.
	Subsection (1) sets out the elements of the offence. These reflect the elements of the previous offence in section 55 of the 1998 Act, except for the addition of unlawful "retention" of data. This has been added to deal with situations where a person obtains data lawfully but then intentionally or recklessly retains it without the consent of the controller.
	Subsections (2) and (3) provide defences where, for example, the data was obtained for the purposes of preventing or detecting crime; to fulfil a legal obligation; for reasons of public interest; for acting in the reasonable belief that they had a legal right or would have had the consent of the data controller; or was obtained for the special purposes, with a view to publication, and the obtaining of the data was reasonably believed to be justified as being in the public interest As worded, the section places a legal burden on the defendant to prove the relevant defences on the balance of probabilities.
	Subsections (4) to (6) make it an offence to sell or offer to sell personal data that was obtained, disclosed or retained unlawfully.