Data, Privacy and Confidentiality Offences

Introduction and context

Modern social, commercial and public life depends on the collection and exchange of data. Organisations hold identity records, financial information, health records, communications, location data, credentials, photographs and business secrets. This concentration of information creates opportunities for innovation but also creates targets for unlawful acquisition, interception, disclosure and misuse.

Data-related misconduct is not a single legal category. The same event may involve a criminal offence, a breach of privacy legislation, a regulatory violation, a breach of contract, a civil wrong, or several of these at the same time. For example, an employee who copies a customer database may commit an offence under computer misuse or data-protection law, breach an employment confidentiality obligation, and expose the employer to regulatory sanctions and civil claims.

This chapter examines the principal forms of unlawful conduct involving data, privacy and confidentiality. Because legal definitions differ between jurisdictions, the chapter uses general principles and identifies where local legislation must be consulted. The central analytical question is not merely whether information was accessed, but whether the access, collection, interception, use, disclosure or retention was authorised, lawful, necessary and proportionate.

Learning objectives

By the end of this chapter, a student should be able to:

1. distinguish data, personal data, confidential information and communications content;
2. explain unlawful acquisition, interception, disclosure, data theft, doxxing and surveillance;
3. distinguish criminal offences from privacy, regulatory and civil violations;
4. apply a structured framework to a suspected data or confidentiality incident;
5. identify relevant evidence, responsible actors and possible remedies; and
6. describe ethical and governance controls that reduce the risk of unlawful data use.

1. Foundational concepts

1.1 Data and information

Data consists of recorded facts, observations or symbols. Information is data interpreted in a context that gives it meaning. In law, however, the distinction is often less important than the nature, source and use of the material. A numerical identifier may appear harmless in isolation but become sensitive when linked to a named person, location or medical record.

Data may be:

• Personal data: information relating to an identified or identifiable natural person. Names, identification numbers, online identifiers, device identifiers and location information may qualify.
• Sensitive or special-category data: information receiving enhanced protection, such as health, biometric, genetic, racial or ethnic, religious, political or sexual information, depending on the jurisdiction.
• Confidential information: information that is not generally public and is subject to an obligation of confidence. This may include trade secrets, legal advice, security procedures and unpublished business plans.
• Authentication data: passwords, private keys, access tokens, recovery codes and biometric templates used to verify identity.
• Communications data: content and associated metadata, such as sender, recipient, time, routing information and device location.
• Anonymised data: data processed so that individuals cannot reasonably be identified using means likely to be available. Pseudonymised data is different: it remains linkable through additional information and may still be personal data.

1.2 Privacy, secrecy and confidentiality

Privacy concerns a person’s ability to control or shield aspects of personal life, identity, body, communications, space and information. Secrecy concerns protection against unauthorised knowledge. Confidentiality is an obligation imposed by a relationship, contract, professional duty, statute or circumstances of disclosure.

These concepts overlap but are not identical. A company’s trade secret is confidential but not personal. A person’s publicly displayed name may be personal data but may not be secret. A doctor’s unauthorised disclosure of a patient’s record can violate privacy, professional confidentiality and data-protection law simultaneously.

1.3 The data lifecycle

A useful way to analyse responsibility is to follow the data lifecycle:

1. collection or creation;
2. access and use;
3. storage and security;
4. sharing or disclosure;
5. retention and archival; and
6. deletion or destruction.

An organisation may lawfully collect information but later use it for an incompatible purpose. Alternatively, the initial collection may be lawful while inadequate security causes a breach. Each stage requires separate analysis.

2. A framework for identifying unlawful conduct

A suspected incident can be analysed through six questions:

1. What data was involved? Identify its sensitivity, ownership, confidentiality and connection to individuals.
2. What act occurred? Possible acts include accessing, copying, intercepting, altering, disclosing, selling, publishing, monitoring or retaining.
3. Who acted and with what authority? Authority may arise from consent, employment, contract, law, court order, system permission or an emergency justification.
4. What was the mental state? Criminal law may require intention, knowledge, recklessness, dishonesty or a specific purpose. A negligent act may support regulatory or civil liability without satisfying a criminal offence.
5. What harm or risk resulted? Harm may include financial loss, identity theft, intimidation, reputational injury, discrimination, physical danger or loss of commercial advantage.
6. Which legal regime applies? Consider criminal law, privacy and data-protection law, communications-interception law, trade-secret law, contract, tort or delict, employment law and professional regulation.

Permission to enter a system is not necessarily permission to copy or disclose everything within it. Similarly, technical ability to obtain data does not create legal authority.

3. Unlawful access, acquisition and data theft

3.1 Unlawful access

Unauthorised access occurs when a person intentionally enters or uses a computer, account, database or network without permission, or exceeds the limits of permission. Common examples include guessing a password, using stolen credentials, exploiting a vulnerability, entering a former employee’s account, or using another person’s unlocked device without authority.

Some legal systems distinguish access with no permission from access that exceeds authorised purposes. This distinction is important. An employee may be authorised to view customer records for service delivery but not to browse a celebrity’s records or download the entire database for personal use.

3.2 Acquisition and copying

Data acquisition includes photographing a screen, exporting records, downloading files, scraping a website, duplicating a database, recording a conversation or extracting information through an application interface. Acquisition may be unlawful even if the original data remains intact. The absence of physical damage does not make copying lawful.

Relevant factors include:

• whether the information was publicly available;
• whether access controls were bypassed;
• whether the person had a legitimate purpose;
• whether terms of use prohibited the conduct;
• whether the volume or sensitivity exceeded the person’s role; and
• whether the person intended to use, sell or disclose the data.

3.3 Data theft

“Data theft” is often used broadly in public discussion. Legally, data may not be property in the same way as a physical object, and the applicable offence may instead be unauthorised access, fraud, unlawful appropriation, trade-secret misappropriation, interference with a computer system or unlawful disclosure. The label should therefore not replace analysis of the statutory elements.

A person who copies a customer list may commit a criminal offence if the law criminalises unauthorised extraction or trade-secret misappropriation. Even where no specific criminal offence applies, the conduct may breach contract, confidence or data-protection duties.

4. Interception and surveillance offences

4.1 Interception

Interception generally involves acquiring communications during transmission, rather than merely accessing stored messages. It may include tapping a telephone line, capturing unencrypted network traffic, installing spyware, redirecting email, or collecting message content through a malicious device.

The legal analysis commonly considers:

• whether the communication was in transmission;
• whether the content or metadata was obtained;
• whether consent was given by one or all participants, as local law requires;
• whether the interceptor was a party to the communication;
• whether a statutory exception or warrant applied; and
• whether the conduct was intentional or reckless.

Stored communications may be governed by separate computer-access, privacy or data-protection rules. The distinction between transmission and storage can be technically difficult, particularly where cloud services synchronise messages across devices.

4.2 Surveillance

Surveillance is the systematic observation, tracking or recording of people, places or activities. It may be overt or covert, human or automated, public-sector or private-sector. Examples include CCTV, GPS tracking, workplace monitoring, browser tracking, facial recognition, spyware and monitoring of communications metadata.

Surveillance is not automatically unlawful. It may be justified by consent, a legitimate operational purpose, public authority, a warrant or a specific statutory power. Lawfulness usually depends on purpose, necessity, proportionality, transparency, duration, access controls and safeguards.

A useful proportionality sequence is:

1. Is the purpose legitimate?
2. Is the surveillance rationally connected to that purpose?
3. Is there a less intrusive method likely to achieve it?
4. Is the intrusion proportionate to the expected benefit?
5. Are retention, access and review controls adequate?

Secret surveillance may become criminal when it involves illegal interception, unauthorised access, stalking, harassment, coercive control or misuse of official powers. It may also be a regulatory or civil violation even where criminal liability cannot be established.

5. Unlawful disclosure and breaches of confidentiality

5.1 Disclosure

Disclosure occurs when information is made available to another person or group. It can occur through publication, email, messaging, verbal communication, screen sharing, sale, upload to a public platform or failure to prevent access. A disclosure need not be made to the whole public; revealing information to one unauthorised recipient may be sufficient.

Disclosure may be unlawful because:

• the person had a legal or contractual duty of confidentiality;
• the information was obtained through an offence;
• a privacy or data-protection rule required a lawful basis and safeguards;
• the disclosure was defamatory, threatening or harassing;
• the information was a trade secret; or
• a court order or statutory restriction prohibited publication.

5.2 Confidentiality obligations

Confidentiality can arise from:

• express contractual terms;
• employment duties;
• professional obligations of lawyers, doctors, accountants and counsellors;
• fiduciary or agency relationships;
• statutory secrecy provisions;
• a non-disclosure agreement; or
• circumstances in which a reasonable person would understand that information was confidential.

A confidentiality duty is not unlimited. Whistle-blowing laws, reporting of serious wrongdoing, legal compulsion, public-interest disclosures and emergency protection may create exceptions. The existence of a public interest is not automatically a defence: the method, scope and accuracy of the disclosure remain important.

5.3 Accidental breaches

An accidental email sent to the wrong recipient may not satisfy a criminal requirement of intent or recklessness, but it can still be a reportable personal-data breach, a breach of contract or evidence of inadequate security. Organisations should therefore avoid treating “no malicious intent” as the end of the investigation.

6. Doxxing and harmful publication

Doxxing is the collection, compilation or publication of personal information about an individual—often including an address, telephone number, workplace, family details or identity records—with the purpose or foreseeable effect of intimidation, harassment, exposure or physical danger.

Doxxing may involve several offences or legal wrongs:

• harassment, stalking or threatening communications;
• unlawful disclosure of protected personal information;
• identity-related offences;
• extortion or coercive control;
• incitement or facilitation of violence;
• breach of confidence; and
• civil claims for privacy, misuse of private information or emotional harm.

The fact that some information was obtained from public sources does not automatically make the compilation lawful. Context, intent, aggregation and foreseeable harm matter. Publishing a business address in a legitimate news report is not equivalent to publishing a private home address to mobilise harassment.

Victims should preserve URLs, timestamps, screenshots, account identifiers and copies of threatening messages without unnecessarily redistributing the harmful material. They should report urgent threats to law enforcement and request platform removal, while recognising that removal procedures do not replace evidence preservation.

7. Criminal, regulatory, privacy and civil liability

The same incident may produce different forms of responsibility. Their purposes and proof requirements differ.

Criminal proceedings generally require proof of both conduct and a prescribed mental element. Regulatory systems may impose duties based on organisational processes and may apply even without malicious intent. Civil claims may focus on loss, confidentiality or reasonable expectations and use a lower standard of proof in many jurisdictions.

8. Evidence and incident response

A sound response combines legal, technical and organisational work.

8.1 Immediate actions

The organisation should contain the incident without destroying evidence. Actions may include disabling compromised accounts, revoking tokens, isolating devices, preserving logs, restricting further disclosure and notifying responsible managers. Investigators should record who took each action, when and why.

8.2 Evidence categories

Important evidence may include:

• authentication and access logs;
• database query and export records;
• email headers and message metadata;
• endpoint, cloud and network logs;
• CCTV or physical-entry records;
• copies of relevant policies and contracts;
• witness accounts;
• forensic images acquired under an appropriate process; and
• records of notifications, takedown requests and remedial steps.

Evidence must be collected lawfully and with integrity. Investigators should document time, source, method, hash values where appropriate, storage location and every transfer. A technically accurate file can still become unreliable if its chain of custody is unexplained.

8.3 Notification and cooperation

Data-protection laws may require notification to a regulator and affected individuals within a specified period. The duty depends on the jurisdiction, type of data and risk to individuals. Unnecessary notification can increase harm, while delayed notification can create regulatory exposure. Legal counsel, incident-response specialists and communications professionals should coordinate the decision.

9. Applied case: unauthorised employee disclosure

This is an illustrative fictional case.

Background

A customer-service employee, Maya, has authorised access to customer records for resolving complaints. Before resigning, she exports 18,000 records containing names, email addresses, purchase histories and partial payment information. She gives the file to a marketing business that pays her. The employer discovers the export after unusual database activity is detected.

Analysis

Maya’s ordinary access does not establish authority to export or sell the records. The relevant conduct includes excessive access, copying, commercial use and disclosure. Depending on local law, possible consequences include unauthorised extraction, unlawful disclosure of personal data, breach of confidence, trade-secret or contract claims, and disciplinary action. The marketing business may incur liability for knowingly receiving or using unlawfully obtained information.

The employer must determine whether the records were actually transferred, which individuals were affected, what data was included and whether the payment information can be misused. It should preserve database logs, Maya’s access records, relevant communications and the original export evidence. It should suspend unnecessary access, revoke credentials and assess notification duties.

Approach and outcome

The employer engages a forensic team, preserves the database and devices under documented procedures, and reports the incident to the relevant authority where required. It notifies affected customers with practical protective advice, seeks deletion and undertakings from the marketing business, and begins civil and employment proceedings. The organisation then introduces export-volume alerts, role-based access, separation of duties and periodic access reviews.

Learning points

1. Legitimate initial access does not imply unlimited use.
2. Data copying may be unlawful even where the original database is not damaged.
3. Criminal, regulatory, civil and employment consequences may coexist.
4. Early evidence preservation is essential.
5. Technical controls and clear confidentiality rules must operate together.

10. Governance, ethics and best practice

Organisations should adopt privacy and confidentiality by design rather than treating compliance as an afterthought. Core controls include:

• data minimisation and purpose limitation;
• documented retention and secure deletion schedules;
• role-based and least-privilege access;
• multi-factor authentication;
• encryption in transit and at rest where appropriate;
• logging, alerting and regular review;
• segregation of sensitive duties;
• staff training and confidentiality agreements;
• vendor due diligence and contractual controls;
• tested incident-response and notification procedures; and
• privacy impact assessments for high-risk processing.

Ethical practice requires more than technical legality. Consent should be informed and meaningful, not hidden in confusing interfaces. Monitoring should respect dignity and autonomy. Automated systems should not infer or expose sensitive characteristics without justification. Artificial intelligence systems can increase risk by ingesting personal data, generating identifying outputs, linking supposedly separate datasets or enabling large-scale surveillance. Organisations should assess provenance, necessity, access, retention, model outputs and human oversight before using personal or confidential data in AI systems.

Challenges and limitations

Anonymisation may fail when datasets are combined. Cloud storage distributes responsibility across jurisdictions. Encryption can protect content while metadata still reveals relationships and behaviour. Cross-border investigations may face conflicting laws, slow evidence requests and different definitions of privacy. Publicly available information can still create serious harm when aggregated. Finally, technical attribution does not by itself prove who acted or what legal authority existed.

A defensible approach therefore combines legal interpretation, factual investigation, technical expertise, proportionality and respect for affected persons. No single security tool can determine whether a use of data is lawful.

Chapter Summary

Data, privacy and confidentiality offences concern more than computer intrusion. They include unauthorised access, copying, interception, surveillance, disclosure, data theft, doxxing and misuse of information obtained through a legitimate role. The legal character of conduct depends on the data involved, the act performed, authority, mental state, harm and applicable law.

Criminal liability requires satisfaction of statutory elements and usually a required mental state. Regulatory, privacy, civil, employment and professional consequences may arise even where criminal liability is uncertain. A structured incident response should identify the data lifecycle stage, preserve evidence, contain harm, assess notification duties and apply proportionate remedies. Least privilege, minimisation, access review, secure systems, staff training and privacy-by-design are central preventive measures.

Key Terms

Personal data: Information relating to an identified or identifiable person.

Sensitive data: Personal information requiring enhanced legal or organisational protection.

Confidential information: Non-public information subject to an obligation of confidence.

Privacy: Protection of personal life, identity, communications, space and information from unjustified intrusion.

Unauthorised access: Access to a system or data without valid permission or beyond permitted limits.

Data acquisition: Obtaining, extracting, recording or copying data.

Data theft: A general expression for unlawful taking, copying, appropriation or misuse of data.

Interception: Acquisition of communications while they are being transmitted.

Surveillance: Systematic observation, tracking or recording of persons, places or activities.

Disclosure: Making information available to an unauthorised person or group.

Doxxing: Publishing or compiling personal information in a manner likely to expose or harm an individual.

Pseudonymisation: Replacing identifiers while retaining the possibility of re-linking data.

Anonymisation: Processing data so that individuals cannot reasonably be identified.

Least privilege: Giving a user only the access necessary for authorised tasks.

Purpose limitation: Using collected data only for specified, lawful and compatible purposes.

Data breach: A security incident involving unauthorised access, loss, alteration or disclosure of data.

Chain of custody: Documented history of evidence collection, handling, transfer and storage.

Proportionality: Requirement that an intrusion or measure not exceed what is justified by its legitimate purpose.

Review Questions

Short Answer Questions

1. Distinguish privacy from confidentiality.
2. Why can copying data be unlawful even when the original data remains unchanged?
3. What is the difference between anonymisation and pseudonymisation?
4. Identify three possible sources of a confidentiality obligation.
5. Name four categories of evidence that may be relevant to a data breach investigation.

Long Answer Questions

1. Explain how the data lifecycle assists analysis of unlawful data conduct.
2. Compare criminal, regulatory, privacy and civil consequences arising from the same incident.
3. Discuss the legal and ethical issues raised by workplace surveillance.
4. Explain why legitimate access to a database does not necessarily authorise copying or disclosure.
5. Describe an organisation’s responsibilities after discovering an unauthorised disclosure of personal data.

Analytical / Application Questions

1. An employee accesses a famous customer’s record out of curiosity, reads it, and tells a friend but does not copy it. Analyse the possible legal and professional consequences.
2. A researcher publishes a person’s home address obtained from public records after an online dispute. Explain which facts are relevant to determining whether the conduct is doxxing or another legal wrong.
3. A company uses an AI service to analyse customer support conversations without reviewing the service provider’s retention or access practices. Identify the privacy, confidentiality, governance and incident-response issues that should be examined.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes confidentiality from privacy?

A. Confidentiality concerns only government information, while privacy concerns only companies.

B. Confidentiality is an obligation to protect non-public information, while privacy concerns protection against unjustified intrusion into personal life or information.

C. Confidentiality always creates criminal liability, while privacy never does.

D. Privacy applies only to data stored electronically, while confidentiality applies only to paper records.

Correct Answer: B. Confidentiality is an obligation to protect non-public information, while privacy concerns protection against unjustified intrusion into personal life or information.

Question 2

An employee is authorised to view customer records to resolve complaints but exports the entire database and sells it. What is the most accurate conclusion?

A. The sale is automatically authorised because the employee had database access.

B. No legal issue arises because the original database was not damaged.

C. The employee may have exceeded authorised access and may face criminal, civil, regulatory and employment consequences.

D. Only the customer, and never the employee, can be liable.

Correct Answer: C. The employee may have exceeded authorised access and may face criminal, civil, regulatory and employment consequences.

Question 3

What generally distinguishes interception from access to stored data?

A. Interception concerns acquiring communications during transmission.

B. Interception requires that data be printed.

C. Stored data is never protected by law.

D. Interception occurs only when a government agency acts.

Correct Answer: A. Interception concerns acquiring communications during transmission.

Question 4

Which practice best reflects the principle of least privilege?

A. Giving every employee administrator access for convenience.

B. Allowing users only the access necessary for their authorised tasks.

C. Removing all access logs to protect employee privacy.

D. Retaining former employees’ credentials indefinitely.

Correct Answer: B. Allowing users only the access necessary for their authorised tasks.

Question 5

Why may publishing information obtained from public sources still constitute doxxing?

A. Public information is always illegal to collect.

B. Doxxing depends only on whether a password was used.

C. Aggregation, context, intent and foreseeable harm may make publication unlawful or harmful.

D. Doxxing applies only to information obtained from government databases.

Correct Answer: C. Aggregation, context, intent and foreseeable harm may make publication unlawful or harmful.

Question 6

Which statement about an accidental disclosure is most accurate?

A. It can never create legal or regulatory consequences because there was no malicious intent.

B. It may fail to satisfy a criminal intent requirement but still create regulatory, contractual or civil consequences.

C. It is automatically treated as intentional interception.

D. It is lawful whenever the recipient promises not to read the information.

Correct Answer: B. It may fail to satisfy a criminal intent requirement but still create regulatory, contractual or civil consequences.

Question 7

What is the primary purpose of maintaining a chain of custody?

A. To increase the amount of data collected.

B. To document the handling and integrity of evidence.

C. To guarantee that the suspect will be convicted.

D. To replace the need for access logs.

Correct Answer: B. To document the handling and integrity of evidence.

Question 8

Which of the following is pseudonymisation rather than anonymisation?

A. Destroying all identifiers and all possible re-identification links.

B. Replacing names with codes while retaining a separate key that can reconnect records to individuals.

C. Publishing names and addresses openly.

D. Deleting the entire dataset.

Correct Answer: B. Replacing names with codes while retaining a separate key that can reconnect records to individuals.

Question 9

Which question is central to a proportionality assessment of surveillance?

A. Is the surveillance technically impressive?

B. Is there a less intrusive method likely to achieve the legitimate purpose?

C. Can the organisation avoid documenting the surveillance?

D. Does the surveillance collect the maximum possible amount of data?

Correct Answer: B. Is there a less intrusive method likely to achieve the legitimate purpose?

Question 10

Which control most directly reduces the risk that a former employee will continue accessing systems?

A. Increasing data retention periods.

B. Disabling accounts and revoking tokens promptly when employment ends.

C. Publishing the employee’s personal information.

D. Removing multi-factor authentication.

Correct Answer: B. Disabling accounts and revoking tokens promptly when employment ends.