Criminal Justice (Offences Relating to Information Systems) Act 2017

Penalties

8. (1) A person who commits an offence under section 2 , 4 , 5 , 6 or 9 (1) shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine or imprisonment for a term not exceeding 5 years or both.

(2) A person who commits an offence under section 3 shall be liable—

(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

(b) on conviction on indictment, to a fine or imprisonment for a term not exceeding 10 years or both.

(3) A person who commits an offence under section 7 (7) shall be liable on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both.

(4) (a) Where a court is determining the sentence to be imposed on a person for an offence under section 3 or 4 , the fact that the commission of the offence involved misusing the personal data of another person (“rightful identity owner”) with the aim of gaining the trust of a third party, thereby causing prejudice to the rightful identity owner, shall be treated as an aggravating factor for the purpose of determining the sentence.

(b) Accordingly, the court shall (except when the court considers that there are exceptional circumstances justifying it not doing so) impose a sentence that is greater than that which would have been imposed in the absence of such a factor.

(c) The sentence imposed shall not be greater than the maximum sentence permissible under this section for the offence concerned under section 3 or 4 .