Call Centre Employee Faces Jail For £45,000 Data Theft

A British Gas employee has admitted selling c. 1,700 customers' personal data for £45,000. Interestingly, this case was prosecuted under both theData Protection Act 2018("the DPA") and theTheft Act 1986(under which those convicted can be imprisoned). Personal data isn't usually considered 'property' under section 4 of the Theft Act, but files can meet the definition of property. This case is an example of the risks posed by insiders and shows that UK authorities are willing to get creative when holding people accountable for misusing personal data for profit.

How the breach happened

The employee in question worked at a Coventry call centre for British Gas. Over six months in 2018, he repeatedly accessed customer accounts and downloaded names, addresses, dates of birth and energy usage details. He then sold this data to a marketing company. British Gas was made aware of the situation when customers started getting cold calls that matched the details in