The head of the government’s privacy watchdog has called for stronger sentencing powers for people convicted of stealing personal data, after a woman who sold 28,000 pieces of sensitive driver data was fined just £1,000.
In the wake of the case information commissioner Christopher Graham said the courts should be given tougher sanctions to deter prospective thieves, including suspended sentences, community service and even prison in very serious cases.
Sindy Nagra, 42 and from Hayes, accessed and sold copies of nearly 28,000 customers’ records while working for a car rental company. They were intercepted and ordered to be destroyed before they were able to be used for nuisance calls.
An administrative assistant at Enterprise Rent-A-Car, Nagra was responsible for processing customer details sent to the car rental company by an insurance company. The records, typically involving the victims of road traffic collisions, included details of the policyholder as well as details of their insurance claim.
Enterprise contacted the Information Commissioners Office after its systems identified that Nagra was looking at large numbers of records, including many she would not have been expected to process. An investigation found that Nagra, who worked from home, had been photographing the records while they were on her computer screen.
It was also found that she had sold copies of 28,000 records, receiving £5,000 in cash. Appearing at Isleworth crown court , she was fined £1,000, ordered to pay a £100 victim surcharge and £864.40 prosecution costs. She pleaded guilty to unlawfully obtaining, disclosing and selling personal data, a criminal offence under section 55 of the Data Protection Act.
“Nuisance-call cowboys and claims-market crooks will pay people to steal personal data” Graham said. “But the fines that courts are issuing at the moment just don’t do enough to discourage would-be data thieves. This fine highlights the limited options the courts have.”
Graham said it was “more important than ever” that the courts had at their disposal more effective deterrent penalties than just fines. “People who break the criminal law by trading in other people’s personal information need to know that they will be severely punished and could even go to prison,” he said.
“We’ve been pushing for this for some time. Parliament voted for it to happen more than seven years ago but it remains on a Westminster backburner. It is high time that changed.”
The legislation voted for in 2008 but not put into action was Section 77 of the Criminal Justice and Immigration Act 2008.
The stolen records were bought by Iheanyi Ihediwa, 39 and from Manchester, whom Nagra claimed she had been introduced to in a pub. Ihediwa appeared before Manchester magistrates’ court on 17 December where he also pleaded guilty to section 55 offences. Ihediwa was fined a total of £1,000 and ordered to pay prosecution costs of £864.40 and a victim surcharge. The court aalso ordered the data to be destroyed.
The ICO prosecuted another Enterprise employee in July 2014. Stephen Siddell, a former branch manager, was prosecuted for unlawfully stealing the records of almost 2,000 customers before selling them to a claims management company. He was fined £500 and ordered to pay a £50 victim surcharge and £264.08 in prosecution costs.
.jpg?w=600)
