ICO issues “record fines” over illegal trade of personal data

The ICO has issued “record fines” over an illegal trade of personal data that involved “rogue private investigators” illegally obtaining financial information for an individual who’d claimed on an insurance policy for a fire at a business premises they owned.

A director and a senior member of staff, together with the private investigators, have been hit with record fines for unlawfully obtaining and disclosing personal data. The investigation reportedly started in 2013 when the Serious Organised Crime Agency passed over a list of ‘blue chip’ clients of criminal private investigators to the ICO.

According to the ICO report, a Crown Court jury returned 15 guilty verdicts following the ICO’s prosecution of the individuals involved in the scandal. The company at the centre of the data breaches, Woodgate and Clark limited, was convicted of unlawfully disclosing personal data and fined £50,000.00, and ordered to pay £20,000.00 in costs.

In addition, director Michael Woodgate was fined £75,000.00 and ordered to pay £20,000.00 in costs, and a senior loss adjuster at the same company, Colum Tudball, was ordered to pay a fine of £30,000.00 and costs of £20,000.00. Both were convicted on charges of unlawfully obtaining personal data, with Woodgate also charged for unlawfully disclosing personal data.

Private Investigators Daniel Summers and Adam Spears were also fined a combined total of £30,000.00 and ordered to pay costs amounting to £22,500.00.

Speaking about the case, Elizabeth Denham of the ICO said:

“The illegal trade in personal information is not only a criminal offence but a serious erosion of the privacy rights of UK citizens. As well as these record fines, the organisations and individuals involved also face serious reputational damage as a result of being prosecuted by the ICO.”

The record fines issued by the ICO demonstrate the power of data protection regulation and should serve as a stern warning to any data controller who considers engaging in unlawfully obtaining and disclosing personal data.