Eight Brits face trial over alleged car crash data ring

The Information Commissioner’s Office has launched criminal proceedings against eight individuals over the alleged unlawful accessing and obtaining of consumers’ personal data from vehicle repair garages to generate potential leads for personal injury claims.

The alleged activity actually took place years ago, between December 1 2014 and November 30 2017. The defendants are alleged to have conspired together to access and obtain the personal data of hundreds of thousands of individuals without the consent of the UK companies concerned.

The defendants will now face prosecution for conspiring to commit an offence under section 1 of the Computer Misuse Act 1990, relating to the alleged unlawful accessing of personal data held on computers, and conspiring to commit an offence under section 55 of the Data Protection Act 1998, relating to the alleged unlawful obtaining of personal data.

This prosecution follows a complex and wide ranging criminal investigation by the ICO. The first hearing will take place at Manchester and Salford Magistrates Court on October 27 2022, although the ICO says it will not be commenting further on these proceedings at this time.

One of the most high profile cases under the Computer Misuse Act brought by the ICO saw a former employee of Nationwide Accident Repair Services sentenced to six months in prison after pleading guilty to stealing thousands of customer records and selling them on to rogue claims firms.

Mustafa Kasim also used his colleagues’ log-in details to access a software system that estimates the cost of vehicle repairs, known as Audatex. He continued to access the data even when he started a new job at a different car repair organisation which used the same software system. The records contained customers’ names, phone numbers, vehicle and accident information.

Kasim was also ordered to pay back £25,500 in a confiscation order.