ICO Cracking Down On Individuals Who Regard Data Theft As A ‘Victimless’ Crime

The ICO recently prosecuted Paul Hedges, a former leisure centre manager, for unlawfully obtaining sensitive medical information relating to 2,471 patients. Hedges was charged £3,000 and ordered to pay a £15 victim surcharge and £1,376 costs. Hedges set up a fitness company having received a redundancy notice from Southampton Council. To promote his new company he forwarded sensitive patient records to himself.

The ICO was satisfied with the Council's data security measures which allowed only relevant employees, including Hedges, to have access to sensitive data. By forwarding the data to himself Hedges was seen to be 'on a frolic of his own' as this was not permitted by the Council.

This case highlights the ICO's willingness to clamp down on individuals who exhibit a blatant disregard for data protection laws: Hedges was told specifically to keep patient details confidential.

The ICO's view is...