ICO: Data thieves must face tougher punishments than fines
Information Commissioner calls for threat of prison sentences after rental car employee sells customer data

Criminals who steal people's personal data must face tougher punishments than small fines, according to the Information Commissioner's Office (ICO).
The data watchdog's renewed call for tougher punishments comes after a woman who sold 28,000 people's personal details to earn 5,000 was only fined 1,000 by a court.
Enterprise Rent-A-Car admin assistant Sindy Nagra, 42, from Hayes, sold the records for cash by photographing them on her computer screen while working from home.
Each customer had been involved in a road traffic collision, and details included those of the policyholder and their insurance claim.
Nagra pleaded guilty of breaching the Data Protection Act at Isleworth Crown Court, but despite being able to issue unlimited fines for the offence, on Friday the court only fined her 1,000, plus a 100 victim surcharge and 864.40 in prosecution costs.
Information Commissioner Christopher Graham said: "The fines that courts are issuing at the moment just don't do enough to discourage would-be data thieves.
"This fine highlights the limited options the courts have. Sindy Nagra got 5,000 in cash in return for stealing thousands of people's information. She lost her job when she was caught, and has no money to pay a fine, and the courts have to reflect that. But we'd like to see the courts given more options: suspended sentences, community service, and even prison in the most serious cases."
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Currently courts cannot issue prison sentences for these kinds of criminal offences, and the person who purchased the records, Iheanyi Ihediwa, 39, from Manchester, was also only fined 1,000.
But Graham added: "With so much concern about the security of data, it is more important than ever that the courts have at their disposal more effective deterrent penalties than just fines.
"People who break the criminal law by trading in other people's personal information need to know that they will be severely punished and could even go to prison. Parliament voted for it to happen more than seven years ago but it remains on a Westminster backburner. It is high time that changed."
-
Women show more team spirit when it comes to cybersecurity, yet they're still missing out on opportunities
News While they're more likely to believe that responsibility should be shared, women are less likely to get the necessary training
By Emma Woollacott
-
OpenAI's new GPT-4.1 models miss the mark on coding tasks
News OpenAI says its GPT-4.1 model family offers sizable improvements for coding, but tests show competitors still outperform it in key areas.
By Ross Kelly
-
AI recruitment tools are still a privacy nightmare – here's how the ICO plans to crack down on misuse
News The ICO has issued guidance for recruiters and AI developers after finding that many are mishandling data
By Emma Woollacott
-
“You must do better”: Information Commissioner John Edwards calls on firms to beef up support for data breach victims
News Companies need to treat victims with swift, practical action, according to the ICO
By Emma Woollacott
-
LinkedIn backtracks on AI training rules after user backlash
News UK-based LinkedIn users will now get the same protections as those elsewhere in Europe
By Emma Woollacott
-
UK's data protection watchdog deepens cooperation with National Crime Agency
News The two bodies want to improve the support given to organizations experiencing cyber attacks and ransomware recovery
By Emma Woollacott
-
ICO slams Electoral Commission over security failures
News The Electoral Commission has been reprimanded for poor security practices, including a failure to install security updates and weak password policies
By Emma Woollacott
-
Disgruntled ex-employees are using ‘weaponized’ data subject access requests to pester firms
News Some disgruntled staff are using DSARs as a means to pressure former employers into a financial settlement
By Emma Woollacott
-
ICO reprimands Coventry school over repeated data protection failures
News The ICO said the academy trust failed to follow previous guidance, which caused a serious data breach
By Emma Woollacott
-
ICO dishes out fine to HelloFresh for marketing spam campaign
News HelloFresh failed to offer proper opt-outs, the ICO said, and customers weren’t warned their data would be used for months after they cancelled
By Emma Woollacott