A six-month prison sentence has been imposed on a motor industry employee following the first Computer Misuse Act prosecution by the ICO
The ICO reports on its first prosecution under the Computer Misuse Act 1990. As a result of the prosecution, a motor industry employee has been sentenced to six months in prison.
Mustafa Kasim, who worked for accident repair firm Nationwide Accident Repair Services (NARS), accessed thousands of customer records containing personal data without permission, using his colleagues’ log-in details to access a software system that estimates the cost of vehicle repairs, known as Audatex. He continued to do this after he started a new job at a different car repair organisation which used the same software system. The records contained customers’ names, phone numbers, vehicle and accident information.
NARS contacted the ICO when they saw an increase in customer complaints about nuisance calls and assisted the ICO with their investigation.
The ICO usually prosecutes cases like this under the Data Protection Act 1998 or 2018, depending on the individual case. However, it considered it appropriate to prosecute this case under the Computer Misuse Act 1990, s 1 to reflect the nature and extent of the offending and for the sentencing court to have a wider range of penalties available.
Mike Shaw, Head of Criminal Investigations at the ICO, said:
‘People who think it’s worth their while to obtain and disclose personal data without permission should think again. Although this was a data protection issue, in this case we were able to prosecute beyond data protection laws resulting in a tougher penalty to reflect the nature of the criminal behaviour. Members of the public and organisations can be assured that we will push the boundaries and use any tool at our disposal to protect their rights.
Data obtained in these circumstances is a valuable commodity, and there was evidence of customers receiving unwarranted calls from claims management companies causing unnecessary anxiety and distress. The potential reputational damage to affected companies whose data is stolen in this way can be immeasurable. Both Nationwide Accident Repair Services and Audatex have put appropriate technical and organisational measures in place to ensure that this cannot happen again.’
Mr Kasim pleaded guilty to a charge of securing unauthorised access to personal data between 13 January 2016 and 19 October 2016, at a hearing in September 2018 and was sentenced at Wood Green Crown Court. Confiscation proceedings under the Proceeds of Crime Act, to recover any benefit obtained as a result of the offending, have been commenced and are ongoing.
Laurence Eastham writes:
I have on a number of occasions pointed out that the call from the ICO for offences under the Data Protection Act to be made imprisonable would be more difficult to resist if the ICO actually used its powers to prosecute for the full offences available. This instance suggests that they have seen a light, perhaps we might see more prosecutions, perhaps by the CPS but with ICO support for fraud and conspiracy, especially conspiracy to defraud. The past record of prosecuting for easily proved data protection offences resulted in the ICO being dissatisfied with the sentence meted out – when that dissatisfaction was largely of their own making.
While I welcome the decision to prosecute under the 1990 Act, a sentence of immediate imprisonment (if that’s what it was) seems surprising, though it is never easy to judge these things without knowing the full facts and antecedents. Given the level of illegal nuisance calls that result in monetary penalties imposed on companies which are never paid, Mustafa Kasim might consider himself unlucky to be in jail.