Data breach: Led to cold calls

A former worker at an accident repair firm who downloaded and sold the personal data of motorists to nuisance callers has been convicted under the Data Protection Act of unlawfully obtaining and disclosing data.

Phillip Bagnall, 33, of Eccles, Greater Manchester, was fined £500 and was also ordered to pay £364 costs and a £50 victim surcharge.

He was an employee of Nationwide Accident Repair Services Limited (NARS) when he was found to be accessing suspicious volumes of customer data from a laptop at home outside of work hours.

According to the Information Commissioner’s Office (ICO), which prosecuted Bagnall, NARS called in cyber security consultants in November 2016 after large numbers of customers began complaining that they were receiving nuisance calls about personal injury claims shortly after engaging its services.

Initial enquiries led to suspicions that Bagnall was involved and it was decided that his access to the company’s computer systems would be monitored.

During just one week, he was found to have accessed the data of 2,724 customers without his employer’s consent.

NARS reported Bagnall to the ICO. He made ‘no comment’ in a subsequent interview and declined to identify the person he sold the data to.

Before Manchester and Salford Magistrates’ Court, he pleaded guilty to unlawfully obtaining data in breach of section 55 of the Data Protection Act 1998. A further charge of unlawfully disclosing data was also admitted and taken into consideration.

ICO criminal enforcement manager Mike Shaw said: “This case serves as a warning to anyone who thinks they can make some quick and easy money selling people’s personal information.”

Meanwhile, barrister Dominic Ruck Keene, who practises from One Crown Office Row, has been reprimanded by the Bar Standards Board after leaving documents on the London Underground back in 2015.

The regulator said that, in so doing, Mr Ruck-Keene “failed to preserve the confidentiality of confidential and highly sensitive data by failing to take adequate or appropriate security measures against accidental loss of personal data”.

The offence was dealt with by a ‘determination by consent’, an agreement that means the case was not sent to a disciplinary tribunal.



Leave a Comment

By clicking Submit you consent to Legal Futures storing your personal data and confirm you have read our Privacy Policy and section 5 of our Terms & Conditions which deals with user-generated content. All comments will be moderated before posting.

Required fields are marked *
Email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Reports

The working practices of property lawyers have changed little since the 19th century. Many aspects of the conveyancing process remain offline – documents are still on paper and the data entered manually. The commercial transaction process is laborious, slow and… Read More

Blog

20 June 2018

New tech on the block: what you need to know about blockchain

Blockchain. It’s been branded as the future of just about everything, and is soon expected to infiltrate all aspects of how we live our lives from banking, to tax returns to voting. But what is it, and how can it be used in property transactions?

Read More

18 June 2018

Surely no one would do this?

It’s slightly tongue-in-cheek, but let’s see if we can design a business model that is doomed to struggle and which will ensure that we miss out on the profit and cash opportunities that come with providing high-value services at high prices in a near-monopoly situation.

Read More