Peter A Clarke

In Company director fined for illegally accessing mobile phone company’s customer database the UK Information Commissioner’s Office highlights the need for staff to be properly trained to deal with attempts by outsiders to access customer database.  The release relates to the prosecution of a a company director who successfully obtained records of 1,066 customers of  Everything Everywhere which he used as a resource for marketing services of his telecommunications companies.  The methodology was quite typical, masquerade as someone who could credibly have access to passwords and logins, such as a person from IT security.  This type of social engineering is common and it is no real excuse for the purposes of the Privacy Act and APP 11 to say the staff were duped and it is not the fault of the organisation affected. Proper staff training and protocols are critical in maintaining proper data security.

The release provides:

A company director has been fined after illegally accessing one of Everything Everywhere’s (EE) customer databases.

Matthew Devlin, 25, from Halifax, Yorkshire, used details of when customers were due a mobile phone upgrade to target them with services offered by his own telecoms companies.

He had impersonated a member of Orange’s security team during calls and emails to legitimate mobile phone distributors, in an attempt to obtain passwords and login details to their customer database. He succeeded on one occasion, and was able to access the records of 1,066 customers.

Devlin, a director of three marketing and telecoms companies, appeared before Calderdale Magistrates’ Court today. He was fined £500, plus £438.63 costs and an £50 victim surcharge.

ICO Head of Enforcement Stephen Eckersley said:

“Personal data is a valuable commodity. Devlin lied and manipulated to access this information for his own profit and now he’s facing a fine and a criminal conviction.

“EE swiftly alerted us to this breach and their security procedures allowed the ICO to identify  Devlin as the perpetrator.”
Unlawfully obtaining or accessing personal data is a criminal offence under section 55 of the Data Protection Act 1998. But perpetrators cannot be jailed the offence is punishable by way of ‘fine only’ – up to £5,000 in a Magistrates Court or an unlimited fine in a Crown Court.

Earlier this month deputy PM Nick Clegg backed the ICO’s call for stronger sentencing powers saying, “The penalties that exist at the moment are pathetic.”

Christopher Graham, Information Commissioner, said:

“Fines like this are no deterrent.  Our personal details are worth serious money to rogue operators. If we don’t want people to steal our personal details or buy and sell them as they like, then we need to show them how serious we are taking this. And that means the prospect of prison for the most serious cases.