Former Employer Fined For Staff Data Protection Breach
- July 29, 2019
- Posted by: John Swift
- Category: Automotive Industry, News, Tips For Dealers
Car dealers are being urged to make sure their data protection systems are robust and working after an employee of one motor firm was sentenced to prison for accessing personal information without permission – and his former employer faced huge costs as a result.
In the first case of its kind, brought up earlier this month by the Information Commissioner’s Office (ICO), and following a hearing at Wood Green Crown Court, London, the judge determined Mustafa Kasim of Palmer’s Green benefited from thousands of pounds as a result of the offences.
Kasim had previously worked for accident repair firm Nationwide Accident Repair Services (NARS) and accessed thousands of customer records containing personal data, without permission. He used his colleagues’ log-in details to access a software system that estimates the cost of vehicle repairs, known as Audatex. He continued to do this after he started a new job at a different car repair organisation which used the same software system. The records contained customers’ names, phone numbers, vehicle and accident information.
Former Employer Faced Huge Remedial Costs
This led to an investigation by the ICO and in November 2018, he became the first person to be imprisoned following an ICO prosecution under the Computer Misuse Act.
Mike Shaw, Group Manager Enforcement at the ICO said:
“Our investigations found that Mr Kasim had benefitted financially from his illegal activity. As a result of his activities, people whose data had been stolen received cold calls and his former employer faced huge remedial costs.
“Personal data obtained in this way can be a valuable commodity and selling it may seem like an easy way to make money but the penalties can be severe. The outcome of this case should serve as a deterrent to others.”
Kasim has been ordered to pay a £25,500 confiscation order. He has three months to pay it under the Proceeds of Crime Act 2002 or could face a 12-month prison sentence. He was also ordered to pay £8,000 in costs.