This article was originally published in Bristows' monthly IT e-newsletter 'The Cookie Jar'.
The Information Commissioner’s Office (ICO) had reason to celebrate earlier this month. A married couple were successfully prosecuted for illegally obtaining and selling personal information contrary to s.55 Data Protection Act 1998 (DPA). The couple, reportedly making £140,000 a year from the crime, were fined a mere £7500 plus costs of £3694. The case provides another insight into the growing undercover market in confidential personal information and supports the call for tougher sentencing.
The facts of the case revolve around Mr and Mrs Anderson of St Ives, Cambridge. In a story reminiscent of the film Shooting Fish, the couple adopted a variety of guises to deceive call centre staff at high profile organisations, persuading them into disclosing the target individual’s personal financial data.
The Andersons would often extract seemingly mundane information at first, in order to give credibility and authority to their ‘characters’. Subsequent attacks were then made to obtain more valuable and personal information. The databases of banks, HM Revenue and Customs, local governments and large companies all proved vulnerable to the couple’s techniques.
The relatively small fine received by the Andersons following their conviction is unlikely to deter others from entering the lucrative market in confidential personal information. The Information Commissioner, Richard Thomas, has recently called for an increased penalty to address the problem. In his report, "What Price Privacy?" (May 2006), he expresses serious concern that weak sentencing powers "underplay the seriousness of section 55 offences" and strongly suggests a custodial sentence should be introduced, up to a maximum of two years.
The call for an increased penalty is also aimed at discouraging the market’s ‘buyers’. The Information Commissioner’s investigation shows that elements of the press and many other businesses have been requesting information which "they must know or suspect has been unlawfully obtained". An investigation published by The Guardian into the Andersons case provides a further example. The couple were regularly sub-contracted by private detective agencies to provide financial information of specific individuals. The article also reveals that these agencies had ultimately been contracted by well-known and reputable businesses.
While the Information Commissioner’s report acknowledges this behaviour is an exception rather than a rule, bringing this issue into the open may be enough to discourage some tempted ‘buyers’. However, the Information Commissioner is adamant that without tougher sentencing, there is little to deter the shadier sections of the private investigation industry from flouting the law.
The ICO press release:
What Price Privacy?
, May 2006:[http://www.ico.gov.uk/upload/documents/library/corporate/research_and_reports/what_price_privacy.pdf]
The Guardian article:
[http://www.guardian.co.uk/crime/article/0,,1947915,00.html
This article was originally published in Bristows' monthly IT e-newsletter 'The Cookie Jar'. If you would like to subscribe to The Cookie Jar please e-mail [email protected]".
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
