{"id":850,"date":"2016-12-28T14:28:38","date_gmt":"2016-12-28T14:28:38","guid":{"rendered":"https:\/\/www.dataleaklawyers.co.uk\/blog\/?p=850"},"modified":"2016-12-28T14:28:38","modified_gmt":"2016-12-28T14:28:38","slug":"ico-fines-2-employees-for-using-personal-data-wrongfully","status":"publish","type":"post","link":"https:\/\/www.dataleaklawyers.co.uk\/blog\/ico-fines-2-employees-for-using-personal-data-wrongfully","title":{"rendered":"ICO fines two employees for a data breach when they used personal data wrongfully"},"content":{"rendered":"

The Information Commissioner’s Office (ICO) has prosecuted two employees, Lesley Severs and Kayleigh Billington, who worked at a claims management company. They both had access to data that was reportedly illegally obtained from another company, to go on to use the personal data to make calls to insurers.<\/p>\n

The personal data in question included information about policy holders and their recent or historic road traffic accidents. The personal data would’ve no doubt included names, addresses, vehicle identification numbers, dates of birth, and so on.
\n
\nBoth employees had been employed at UK Claims Organisation Ltd to make calls to insurance companies in order to obtain personal information. The aim of this was then to sell on personal injury cases to solicitors. It’s unknown whether the employees had knowledge of the unlawfully obtained data, but their deceit was magnified by the fact that they had used the personal data to obtain more information.<\/p>\n

How does the employees’ actions breach the DPA?<\/h2>\n

The Data Protection Act (DPA) and its principles provide that a subject, with whom the data belongs to, shall have full authority of how and what the data is being processed and used for. Anyone handling personal data is named as a data controller, and being a data controller carries serious legal responsibilities. A data controller effectively keeps or processes information about data subjects.<\/p>\n

The first thing to note is that the information obtained from the car hire company was done so unlawfully. The data controller of that company was responsible for keeping that personal data private, but they failed to do so.<\/p>\n

Secondly, a data processor is an individual or entity that processes personal data but doesn’t necessarily control the data. The employees at UK Claims Organisation are arguably data processors. Although data processors have limited responsibilities under the DPA, the employees’ acts constitutes to an unlawful processing of data. They didn’t have the authority to use the data in the manner that they did.<\/p>\n

Consequences of a breach of the DPA<\/h3>\n

With DPA breaches, there can be penalties and compensation. If a company or an organisation breached their DPA responsibilities, they can be fined by the ICO, as the case is here. Their powers include:<\/p>\n

\n