In his May 2006 report to Parliament, What Price Privacy?, the Information Commissioner, Richard Thomas, revealed that he had uncovered evidence of a black market for illegally obtained personal information. In the commissioner's opinion, custodial penalties were required to stamp this out. In February 2007, following a period of consultation, the Lord Chancellor announced that the government will introduce legislation to amend section 55 of the Data Protection Act, to bring in custodial penalties.

Section 55 makes it a criminal offence to obtain personal data from data controllers without their consent if this is done knowingly or recklessly. Procuring the disclosure of personal data without the controller's consent is also an offence, as is selling illegally obtained data or offering to sell it. These offences are colloquially known as 'data theft'.

The commissioner has found that private investigators are at the heart of the black market, and this has obvious consequences for solicitors who, as a profession, are prolific users of investigatory services. Indeed, law firms have already been caught up in the wake of regulatory action commenced by the commissioner (see Hughes v Carratu International PLC [2006] EWHC 1791).

The primary risk for solicitors is that, by using the services of private investigators, they could trigger the commission of a data theft offence. If so, they could be held criminally responsible, a risk heightened by the 'recklessness' component within section 55.

Of course, solicitors should not limit their concerns to the Data Protection Act. Already this year we have seen users of private investigators jailed for privacy offences under the Regulation of Investigatory Powers Act 2000 (the Royal eavesdropping case) and for data offences under the Computer Misuse Act 1990 (the Waters case involving a husband installing surveillance software on his wife's computer during a divorce). Another alternative is section 2 of the Fraud Act 2006 (false representation), or the Protection from Harassment Act 1997.

A solicitor's liability for the unlawful actions of private investigators extends beyond criminal law. A solicitor who obtains illegally obtained information is potentially liable in a civil claim brought under the newly invigorated law of confidence.

Potential claimants include those whose information has been unlawfully obtained and those from whom information has been unlawfully obtained (if different). The Norwich Pharmacal procedure was unsuccessfully sought recently against solicitors in a case of alleged breach of confidence (see Nikitin & ors v Richards Butler & ors [2007] EWHC 173) and is certainly an option to be used against private investigators to uncover the identity of their instructing solicitors.

Solicitors need to think very carefully about the risks of using private investigators and how to avoid responsibility for their illegal or unlawful acts. This extends to an analysis of the investigators used, and how they are instructed.

Stewart Room is a partner in the privacy and information law group at City firm Field Fisher Waterhouse