Smash 'n' grab: Car rental man sentenced for data theft

A man who unlawfully accessed motorists’ personal data from Enterprise Rent-A-Car to pursue personal injury claims for financial gain has been sentenced following an investigation by the Information Commissioner’s Office.

Jonathan Riches, 46, pleaded guilty to an offence under section 55 of the Data Protection Act 1998 at Cardiff Crown Court. The offences were committed between 2009 and 2011.

Her Honour Judge Francis handed down the sentence of a £10,000 fine, plus costs of £1,700.

Riches had previously been an employee of Enterprise Rent-A-Car, then left in 2009 to set up his own personal injury firm. He was still in contact with former colleagues, and through this would illegally obtain the details of those involved in road traffic accidents then contact them offering legal services.

At one point, Riches, through his accomplices, had access to the internal Enterprise database, allowing him to get hold of the personal details of clients.

He had previously been ordered to pay Enterprise Rent-A-Car a £300,000 civil settlement, then was interviewed by the ICO’s criminal investigations team the following year. He was first summonsed to appear in court in 2016, which he failed to do and fled to the US. A warrant was then issued for his arrest. He returned and surrendered himself to authorities earlier this year.

ICO head of investigations Andy Curry said: “We are pleased to see justice has been served in this case. Riches spearheaded a brazen operation, through his accomplices illegally accessing Enterprise Rent-A-Car systems in order to steal data which he then used to enrich himself to the tune of hundreds of thousands of pounds.

“His scheme, which involved the unauthorised use of people’s personal data, was not only illegal, but it also meant people received nuisance calls asking them if they wanted to make a personal injury claim.

“The sentence delivered today demonstrates justice in this case, despite the prosecution and sentencing being delayed for a significant period by the defendant absconding to the US.

“We would like to extend our thanks to Enterprise Rent-A-Car who informed the ICO of the breach as soon as they were aware of it due to the measures they have in place to avoid and mitigate the actions of those who commit criminal offences and for their support in this case.”

Riches’s accomplices in the crimes, Jamie Leong, Michelle Craddock and Andrew Minty, were all previously sentenced. The Judge told Riches it was a sophisticated and long-running agreement which involved a cynical breach of trust. The Judge ruled that this must be paid within 12 months, or will default to a custodial sentence of nine months.

Riches is certainly not the first Enterprise Rent-A-Car employee to be fingered for data theft. In 2014, boss Stephen Siddell was ordered to pay just over £800 for stealing 2,000 customers’ records.

Wirral Magistrates Court heard how the “greedy” 29-year-old pinched the records of customers – who had been involved in accidents while renting cars – and flogged them to a claims management company.