UK insurance company Hiscox is facing an unlimited fine in a landmark court case brought by the Information Commissioner’s Office, in which the firm is accused of breaching data protection laws by forcing a customer to prove he did not have a criminal record before it would pay out on a claim.
The case, being heard at Southwark Crown Court, is believed to be one of the first prosecutions of its kind brought by the ICO and centres on a claim over the loss of a £30,000 Audemars Piguet Royal Oak watch.
The court heard how policy-holder Irfan Hussain had taken out household contents insurance in 2010 with Hiscox, covering his London home, including his watch, which was insured for £30,000. In his policy application form he declared he had no criminal convictions.
But when Hussain lost the watch later that year and made a claim, Hiscox is alleged to have required Hussain to supply information about any criminal convictions before the company would cough up.
Hiscox asked the claimant to make a subject access request to the Criminal Records Office for information about any criminal convictions or police cautions relating to him, the jury heard.
Hiscox is accused of asking Hussain to supply these records on three occasions in April, May and September 2015, after legislation updating the 1998 Data Protection Act had come into force that prohibited companies from making such demands.
Ben Summers, a barrister for the ICO, told the jury: “We say that after the [legislation] came into force, the defendant company repeated that request on three occasions and each of these constituted an offence.”
Hiscox denies the charges; according to reports it will argue that it was in the public interest to request Hussain to seek the information from the Criminal Records Office.
The trial continues.
Thousands of Morrisons staff to get data leak pay-off
Morrisons staff start High Court fight over 2014 breach
Morrisons staff take legal action over 2014 breach
Noose tightens on rogue and lax firms as ICO fines soar
Car crash data thieves hit for £400,000 in civil case
ICO slams Govt inaction after paltry data theft fine