Ex T-Mobile UK workers fined for stealing and selling customer info

The pair of T-Mobile UK employees who stole confidential subscriber data and sold it to a rival wireless company in 2008 were hit with £73,700 ($121,000) in "fines and confiscation costs" this week as a part of their hearing at Chester Crown Court (Case# T20100382), if the fines are not paid, the men face up to 18 months in prison.

The former employees, David Turley and Darren Hames, pled guilty last year to multiple violations of Section 55 of the UK's Data Protection Act of 1998. This section of the act makes it a criminal offense to "knowingly or recklessly obtain or disclose personal data or information without consent of the data controller."

Turley and Hames obtained a list of "several hundred thousand" T-Mobile UK subscribers that included name, address, phone number, and the date when their T-Mobile contracts would expire.

This list was then sold to a competing wireless company who used it to hit subscribers with unsolicited sales calls when the end of their T-Mobile contract was approaching.

At the time, UK privacy watchdog agency ICO (Information Commissioner's Office) called it the biggest data breach of its kind, but did not disclose which rival carrier bought the stolen information, T-Mobile enlisted ICO's help in 2008.

"Those who have regular access to thousands of customer details may
think that attempts to use it for personal gain will go undetected. But this
case shows that there is always an audit trail and my office will do
everything in its power to uncover it," Information Commissioner, Christopher Graham, said today.

The "confiscation costs" Turley and Hames must pay are the result of the Proceeds of Crime Act 2002 which sends the money to the prosecutors to fund prevention and detection of crime. The ICO says its cut of the money will be used to fund training for its investigative staff.