Former MD made £1.5mn by selling personal data of accident victims
News / MD of accidental claims firm made £1.5m by selling personal data of accident victims
1 July 2019
The Manchester City & Salford Magistrates Court has fined a former managing director of Accident Claims Limited for illegally obtaining and selling personal data belonging to victims of road accidents to solicitors.
The Information Commissioner’s Office said in a press release that David Cullen, who was the managing director of Manchester-based Accident Claims Limited between 4 March 2010 until 20 December 2012, earned as much as £1,434,679.60 by “selling illegally obtained personal data to solicitors”.
Personal data obtained by solicitors from Accident Claims Limited were to be used by them to pursue personal injury claims. Cullen has been fined £1,050 and ordered to pay £250 costs for selling illegally-obtained personal data under the Proceeds of Crime Act 2002.
According to ICO, the fine levied is small considering Cullen’s financial circumstances and if his prospects improve in the future, the amount of the confiscation order can be increased.
“The volume of confidential personal information found in Cullen’s possession showed his blatant disregard of people’s right to privacy and our data protection laws.
“The confiscation order under the Proceeds of Crime Act is a warning shot to anyone using or thinking about using personal data illegally. We can and will take action which can have a huge effect on your personal life including confiscating assets and earnings – whatever they may be,” said Michael Shaw, Group Manager – Enforcement at the ICO.
Multiple instances of firms selling personal data to buyers
Last year, the ICO also issued a fine of £140,000 to pregnancy and childcare advice firm Emma’s Diary for collecting and selling personal data of more than one million people, including new mums, to The Labour Party prior to the 2017 General Election.
According to the ICO, personal data obtained by The Labour Party from Emma’s Diary allowed the party to “send targeted direct mail to mums living in areas with marginal seats about its intention to protect Sure Start Children’s centres”.
Emma’s Diary supplied 1,065,220 personal data records to Experian Marketing Services in May last year as part of an agreement where The Labour Party was listed as the latter’s client.
Personal data sold by Emma’s Diary to Experian included names of parents, home addresses, children’s dates of birth, and presence of children up to five years old. Such data was provided to the firm by young mums at the time of online and offline registrations.
In 2017, the ICO found the Royal Free NHS Foundation Trust guilty of sharing 1.6 million patient records with UK-based Google DeepMind to enable the latter to ‘develop and deploy a new clinical detection, diagnosis and prevention application and the associated technology platform’ for the former.
Even though the Trust said it shared nearly 1.6 million ‘partial patient records containing sensitive identifiable personal information’ only for clinical safety tests and for no other purpose, the ICO ruled that the trust failed to adequately inform patients that their data would be used by DeepMind for conducting clinical safety tests.