The ICO reports on its first prosecution under the Computer
Misuse Act 1990. As a result of the prosecution, a motor industry employee has
been sentenced to six months in prison.
Mustafa Kasim, who worked for accident repair firm
Nationwide Accident Repair Services (NARS), accessed thousands of customer
records containing personal data without permission, using his colleagues’
log-in details to access a software system that estimates the cost of vehicle
repairs, known as Audatex. He continued to do this after he started a new job
at a different car repair organisation which used the same software system. The
records contained customers’ names, phone numbers, vehicle and accident
information.
NARS contacted the ICO when they saw an increase in customer
complaints about nuisance calls and assisted the ICO with their investigation.
The ICO usually prosecutes cases like this under the Data
Protection Act 1998 or 2018, depending on the individual case. However, it considered
it appropriate to prosecute this case under the Computer Misuse Act 1990, s 1
to reflect the nature and extent of the offending and for the sentencing court
to have a wider range of penalties available.
Mike Shaw, Head of Criminal Investigations at the ICO, said:
‘People who think it’s worth their while to obtain and
disclose personal data without permission should think again. Although this was
a data protection issue, in this case we were able to prosecute beyond data
protection laws resulting in a tougher penalty to reflect the nature of the
criminal behaviour. Members of the public and organisations can be assured that
we will push the boundaries and use any tool at our disposal to protect their
rights.
Data obtained in these circumstances is a valuable
commodity, and there was evidence of customers receiving unwarranted calls from
claims management companies causing unnecessary anxiety and distress. The
potential reputational damage to affected companies whose data is stolen in
this way can be immeasurable. Both Nationwide Accident Repair Services and
Audatex have put appropriate technical and organisational measures in place to
ensure that this cannot happen again.’
Mr Kasim pleaded guilty to a charge of securing unauthorised
access to personal data between 13 January 2016 and 19 October 2016, at a
hearing in September 2018 and was sentenced at Wood Green Crown Court. Confiscation
proceedings under the Proceeds of Crime Act, to recover any benefit obtained as
a result of the offending, have been commenced and are ongoing.
Laurence Eastham writes:
I have on a number of occasions pointed out that the call
from the ICO for offences under the Data Protection Act to be made imprisonable
would be more difficult to resist if the ICO actually used its powers to
prosecute for the full offences available. This instance suggests that they have
seen a light, perhaps we might see more prosecutions, perhaps by the CPS but with
ICO support for fraud and conspiracy, especially conspiracy to defraud. The
past record of prosecuting for easily proved data protection offences resulted
in the ICO being dissatisfied with the sentence meted out – when that
dissatisfaction was largely of their own making.
While I welcome the decision to prosecute under the 1990
Act, a sentence of immediate imprisonment (if that’s what it was) seems
surprising, though it is never easy to judge these things without knowing the full
facts and antecedents. Given the level of illegal nuisance calls that result in
monetary penalties imposed on companies which are never paid, Mustafa Kasim
might consider himself unlucky to be in jail.
