WIREDGOV

A former Barclays Bank employee has been fined £3,360 after illegally accessing the details of a customer’s account. In one case the employee, Jennifer Addo, found out the number of children the customer had and passed the details to the customer’s then partner, who was a friend of Ms Addo.

Appearing at Croydon Magistrates Court today, 27-year-old Ms Addo was prosecuted under section 55 of the Data Protection Act and fined £2,990 for 23 offences and ordered to pay a £120 victim surcharge and £250 prosecution costs.
 
The bank was alerted to Ms Addo’s activities when the customer contacted the bank to report that information from his account appeared to have been passed to his then partner. An investigation was launched by the bank that discovered Ms Addo had illegally accessed the customer’s details on 22 occasions between 10 May 2011 and 8 August 2011. This was despite Barclays informing its staff that they should not access customers’ accounts unless required.

When interviewed by her employer, Addo confirmed that she was aware that the complainant’s details should not have been accessed, but still decided to look at the complainant’s file and pass information to her friend. Ms Addo failed to respond to the ICO’s enquiries leading up to today’s prosecution.

ICO Head of Enforcement, Stephen Eckersley, said:

“The banking industry has rigorous procedures and safeguards in place to make sure customers’ details are kept secure.  However banks rely on the honesty and professionalism of their staff to ensure that the privileged access given to their records is not abused for personal gain.

“Jennifer Addo knew she was breaking the law by inappropriately accessing the complainants’ details and passing information to a third party but still decided to act. She is now facing the consequences of her actions.

“This case proves, yet again, why we need a more appropriate penalty for the crime of personal data theft. With the law as it stands, this prosecution isn’t even recorded on the police national computer which means that an offender could apply for a job in a high street bank tomorrow and the potential employer wouldn’t be informed about the offence. The current 'fine only' regime is clearly not deterring people from breaking the law.”

Unlawfully obtaining or accessing personal data is a criminal offence under section 55 of the Data Protection Act 1998. The offence is punishable by way of ‘fine only’ - up to £5,000 in a Magistrates Court or an unlimited fine in a Crown Court. The ICO continues to call for more effective deterrent sentences, including the threat of prison, to be available to the courts to stop the unlawful use of personal information.

Ms Addo’s employment at Barclays Bank was terminated shortly after the complaint was raised.

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.

3. The ICO is on Twitter, Facebook and LinkedIn, and produces a monthly e-newsletter.

4. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure 
• Not transferred to other countries without adequate protection

5. If you need more information, please contact the ICO press office on 0303 123 9070.