A body repair technician has been sentenced to jail for stealing customers’ personal data from his former employer, marking the first case prosecuted by the UK’s privacy watchdog to get a jail term.
Mustafa Kasim used a former co-workers’ login details to access the workshop’s computer system and steal accident information including the names, phone numbers and vehicle details of those involved, according to the Information Commissioner’s Office (ICO).
The ICO usually prosecutes under GDPR-based Data Protection Act 2018, which cannot lead to a prison sentence, but for the first time it used the Computer Misuse Act 1990 – giving the sentencing court a wider range of penalties.
Computer Misuse Act 1990
Mike Shaw, group manager of the ICO’s criminal investigations team, said: “Although this was a data protection issue, in this case we were able to prosecute beyond data protection laws resulting in a tougher penalty to reflect the nature of the criminal behaviour.
“Data obtained in these circumstances is a valuable commodity, and there was evidence of customers receiving unwarranted calls from claims management companies causing unnecessary anxiety and distress.
“The potential reputational damage to affected companies whose data is stolen in this way can be immeasurable.
“Both Nationwide Accident Repair Services and Audatex have put appropriate technical and organisational measures in place to ensure that this cannot happen again.”
Mustafa Kasim pleaded guilty to a charge of securing unauthorised access to personal data between 13 January 2016 and 19 October 2016.
He was sentenced to six months in prison at London’s Wood Green Crown Court.
Share your comments below.