Six-month sentence handed for data abuse in landmark ICO prosecution

Data regulator hints seeking tougher punishment was an effort to change behaviour in how personal data is held and processed

A motor industry employee has been given a six-month prison sentence for accessing customer records without permission in a landmark prosecution led by the Information Commissioner's Office (ICO).

Mustafa Kasim pleaded guilty on one charge of securing unauthorised access to personal data between January and October 2016, and was sentenced to six months under the Computer Misuse Act (CMA) 1990.

Advertisement - Article continues below

Kasim, who worked for accident repair firm Nationwide Accident Repair Services (NARS), accessed the personal data of thousands of customers on the Audatex IT platform using his colleagues' login details.

This is the first time the ICO has led a prosecution charge in 28 years since the Act came into force, and was motivated by a desire to inflict a tougher punishment on Mustafa Kasim than is conventionally handed for data misuse.

"People who think it's worth their while to obtain and disclose personal data without permission should think again," said the ICO's group manager of the criminal investigations team Mike Shaw.

"Although this was a data protection issue, in this case we were able to prosecute beyond data protection laws resulting in a tougher penalty to reflect the nature of the criminal behaviour.

"Members of the public and organisations can be assured that we will push the boundaries and use any tool at our disposal to protect their rights."

Kasim continued to access customers' personal data when he left NARS and started a new job at a different car repair organisation which used the same software. These details included customers' names, phone numbers, as well as vehicle and accident information.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

NARS approached the ICO upon receiving increased complaints from customers about receiving nuisance calls.

"Data obtained in these circumstances is a valuable commodity, and there was evidence of customers receiving unwarranted calls from claims management companies causing unnecessary anxiety and distress," Shaw continued.

"The potential reputational damage to affected companies whose data is stolen in this way can be immeasurable. Both Nationwide Accident Repair Services and Audatex have put appropriate technical and organisational measures in place to ensure that this cannot happen again."

Cases such as this, concerning data abuse, are normally prosecuted under Data Protection Act (DPA) 1998, or the EU's General Data Protection Regulation (GDPR) which came into force earlier this year.

However, with the timing of the case rendering GDPR inapplicable, and punishment under the DPA 1998 not deemed severe enough, the ICO opted to prosecute Kasim under different legislation.

In this case, the ICO chose section one of the CMA 1990, which prohibits the use of a computer to intentionally gain access to programmes or data held. This offence carries a maximum prison sentence of two years.

Advertisement - Article continues below

The data regulator said "in appropriate cases" it had the remit to prosecute cases via alternative legislation "to reflect the nature and extent" of offences, and so that the court has "a wider range of penalties available".

"This was an appropriate case to pursue under CMA 1990 because the seriousness of this particular offence, which had a number of aggravating factors, meant that a sentence limited to a fine under the DPA would not have reflected the culpability of the offender," an ICO spokesperson told IT Pro.

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Computer Misuse Act 'putting critical UK infrastructure at risk'
Computer Misuse Act

Computer Misuse Act 'putting critical UK infrastructure at risk'

22 Jan 2020
ICO to relax GDPR enforcement during coronavirus economic downturn
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
The NHS teams up with Apple and Google on coronavirus tracking app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020
Health sites are 'unlawfully' sharing medical data with Facebook and Google
data protection

Health sites are 'unlawfully' sharing medical data with Facebook and Google

7 Apr 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020