IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Six-month sentence handed for data abuse in landmark ICO prosecution

Data regulator hints seeking tougher punishment was an effort to change behaviour in how personal data is held and processed

gavel and keyboard

A motor industry employee has been given a six-month prison sentence for accessing customer records without permission in a landmark prosecution led by the Information Commissioner's Office (ICO).

Mustafa Kasim pleaded guilty on one charge of securing unauthorised access to personal data between January and October 2016, and was sentenced to six months under the Computer Misuse Act (CMA) 1990.

Kasim, who worked for accident repair firm Nationwide Accident Repair Services (NARS), accessed the personal data of thousands of customers on the Audatex IT platform using his colleagues' login details.

This is the first time the ICO has led a prosecution charge in 28 years since the Act came into force, and was motivated by a desire to inflict a tougher punishment on Mustafa Kasim than is conventionally handed for data misuse.

"People who think it's worth their while to obtain and disclose personal data without permission should think again," said the ICO's group manager of the criminal investigations team Mike Shaw.

"Although this was a data protection issue, in this case we were able to prosecute beyond data protection laws resulting in a tougher penalty to reflect the nature of the criminal behaviour.

"Members of the public and organisations can be assured that we will push the boundaries and use any tool at our disposal to protect their rights."

Kasim continued to access customers' personal data when he left NARS and started a new job at a different car repair organisation which used the same software. These details included customers' names, phone numbers, as well as vehicle and accident information.

NARS approached the ICO upon receiving increased complaints from customers about receiving nuisance calls.

"Data obtained in these circumstances is a valuable commodity, and there was evidence of customers receiving unwarranted calls from claims management companies causing unnecessary anxiety and distress," Shaw continued.

"The potential reputational damage to affected companies whose data is stolen in this way can be immeasurable. Both Nationwide Accident Repair Services and Audatex have put appropriate technical and organisational measures in place to ensure that this cannot happen again."

Cases such as this, concerning data abuse, are normally prosecuted under Data Protection Act (DPA) 1998, or the EU's General Data Protection Regulation (GDPR) which came into force earlier this year.

However, with the timing of the case rendering GDPR inapplicable, and punishment under the DPA 1998 not deemed severe enough, the ICO opted to prosecute Kasim under different legislation.

In this case, the ICO chose section one of the CMA 1990, which prohibits the use of a computer to intentionally gain access to programmes or data held. This offence carries a maximum prison sentence of two years.

The data regulator said "in appropriate cases" it had the remit to prosecute cases via alternative legislation "to reflect the nature and extent" of offences, and so that the court has "a wider range of penalties available".

"This was an appropriate case to pursue under CMA 1990 because the seriousness of this particular offence, which had a number of aggravating factors, meant that a sentence limited to a fine under the DPA would not have reflected the culpability of the offender," an ICO spokesperson told IT Pro.

Featured Resources

The 3D skills report

Add 3D skills to your creative toolkits and play a sizeable role in the digital future

Free Download

The increasing need for environmental intelligence solutions

How sustainability has become a major business priority and is continuing to grow in importance

Free Download

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

Solve global challenges with machine learning

Tackling our word's hardest problems with ML

Free Download

Most Popular

Windows 10 users locked out of devices by unskippable Microsoft 365 advert

Windows 10 users locked out of devices by unskippable Microsoft 365 advert

3 Feb 2023
Why energy efficient technology is key to a sustainable business

Why energy efficient technology is key to a sustainable business

16 Jan 2023
What's powering Britain’s fibre broadband boom?
Network & Internet

What's powering Britain’s fibre broadband boom?

3 Feb 2023