The Information Commissioner’s Office (ICO) has prosecuted an individual under the Computer Misuse Act 1990 (CMA 1990), resulting in a six-month prison sentence. This prosecution is the first of its kind by the ICO.
The defendant was a man named Mustafa Kasim. Mr Kasim was employed in the motor repair industry and had used a colleague’s log-in details to access a software system. This allowed Mr Kasim to access the personal data of customers, such as their names, phone numbers, and vehicle and accident information, without permission. Mr Kasim continued to access the software after moving to a different organisation.
Mr Kasim’s previous employer noticed an increase in complaints about nuisance calls. It notified the ICO about the suspected breach and assisted the ICO with the investigation.
Mr Kasim pleaded guilty to securing unauthorised access to personal data. Proceedings to confiscate the benefits of the crime have commenced.
The ICO usually prosecutes cases under the relevant data protection act (DPA). In this case, the ICO decided that an action under the CMA 1990 was more appropriate, given the “nature of the criminal behaviour”. The ICO believed this should attract a more severe penalty than the DPA 1998 could provide. The offence took place in 2016, which pre-dates the DPA 2018. The DPA 2018 implements the General Data Protection Regulation (GDPR) in the UK.
Enforcement is increasing in quantity and severity. The ICO has always had a wide range of enforcement powers. This case demonstrates that the ICO is open to using whichever power it deems necessary to achieve a satisfactory level of enforcement. Mike Shaw, head of criminal investigations at the ICO, commented that the ICO will “push the boundaries” to protect individuals’ rights.
The enforcement action in this case was directed at the individual. However, organisations should view this as a warning. Increased ICO enforcement and tougher punishments are likely. Companies that process personal data can expect the ICO to pay even closer attention from now on.