Information Commissioner’s Office prosecutes Data Protection Act breaches

Over the course of a single month back in 2019, the RAC had received 21 separate complaints from suspicious drivers who received calls from claims management companies following accidents in which the RAC had assisted.

A subsequent review of individuals who had accessed these claims found that Khan was the only employee to access all 21 of them. An internal RAC investigation later reported suspicious behaviour from Khan, including him taking photographs of his computer screen with his mobile phone.

A search warrant, executed by the Information Commissioner’s Office (ICO), resulted in the seizure of two phones from Khan in addition to a customer receipt for £12,000. The mobile phones contained photographs of data relating to over 100 road incidents.

Appearing last month at Dudley Magistrates’ Court, Khan pleaded guilty to two counts of stealing data in breach of Section 170 of the Data Protection Act 2018. He was duly fined the sum of £5,000 and ordered to pay a victim surcharge in addition to court costs.

Stephen Eckersley, director of investigations at the ICO, commented: “Being involved in a road traffic accident can be a deeply distressing experience. To then have your data stolen as a result adds insult to injury. We know that receiving nuisance calls can be hugely frustrating and also that people often wonder how these companies access these personal details in the first place. This case shows one such way that it happens, but also shows that those who commit this crime will be caught and convicted. Justice will be served.”