Six-month sentence handed for data abuse in landmark ICO prosecution

Data regulator hints seeking tougher punishment was an effort to change behaviour in how personal data is held and processed

A motor industry employee has been given a six-month prison sentence for accessing customer records without permission in a landmark prosecution led by the Information Commissioner's Office (ICO).

Mustafa Kasim pleaded guilty on one charge of securing unauthorised access to personal data between January and October 2016, and was sentenced to six months under the Computer Misuse Act (CMA) 1990.

Kasim, who worked for accident repair firm Nationwide Accident Repair Services (NARS), accessed the personal data of thousands of customers on the Audatex IT platform using his colleagues' login details.

This is the first time the ICO has led a prosecution charge in 28 years since the Act came into force, and was motivated by a desire to inflict a tougher punishment on Mustafa Kasim than is conventionally handed for data misuse.

"People who think it's worth their while to obtain and disclose personal data without permission should think again," said the ICO's group manager of the criminal investigations team Mike Shaw.

"Although this was a data protection issue, in this case we were able to prosecute beyond data protection laws resulting in a tougher penalty to reflect the nature of the criminal behaviour.

"Members of the public and organisations can be assured that we will push the boundaries and use any tool at our disposal to protect their rights."

Kasim continued to access customers' personal data when he left NARS and started a new job at a different car repair organisation which used the same software. These details included customers' names, phone numbers, as well as vehicle and accident information.

NARS approached the ICO upon receiving increased complaints from customers about receiving nuisance calls.

"Data obtained in these circumstances is a valuable commodity, and there was evidence of customers receiving unwarranted calls from claims management companies causing unnecessary anxiety and distress," Shaw continued.

"The potential reputational damage to affected companies whose data is stolen in this way can be immeasurable. Both Nationwide Accident Repair Services and Audatex have put appropriate technical and organisational measures in place to ensure that this cannot happen again."

Cases such as this, concerning data abuse, are normally prosecuted under Data Protection Act (DPA) 1998, or the EU's General Data Protection Regulation (GDPR) which came into force earlier this year.

However, with the timing of the case rendering GDPR inapplicable, and punishment under the DPA 1998 not deemed severe enough, the ICO opted to prosecute Kasim under different legislation.

In this case, the ICO chose section one of the CMA 1990, which prohibits the use of a computer to intentionally gain access to programmes or data held. This offence carries a maximum prison sentence of two years.

The data regulator said "in appropriate cases" it had the remit to prosecute cases via alternative legislation "to reflect the nature and extent" of offences, and so that the court has "a wider range of penalties available".

"This was an appropriate case to pursue under CMA 1990 because the seriousness of this particular offence, which had a number of aggravating factors, meant that a sentence limited to a fine under the DPA would not have reflected the culpability of the offender," an ICO spokesperson told IT Pro.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

1Password targets enterprise customers with Secrets Automation
IT infrastructure

1Password targets enterprise customers with Secrets Automation

14 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Ubiquiti insider says the company downplayed the severity of a major breach
data breaches

Ubiquiti insider says the company downplayed the severity of a major breach

31 Mar 2021
Forex broker FBS leaves millions of customer records exposed
data breaches

Forex broker FBS leaves millions of customer records exposed

25 Mar 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Roadmap 2021: What’s coming from 3CX
Advertisement Feature

Roadmap 2021: What’s coming from 3CX

30 Mar 2021