Skip to main contentSkip to navigationSkip to navigation
Elizabeth Denham, the information commissioner
Elizabeth Denham, the information commissioner, says the illegal trade in personal information is ‘a serious erosion of the privacy rights of UK citizens’
Elizabeth Denham, the information commissioner, says the illegal trade in personal information is ‘a serious erosion of the privacy rights of UK citizens’

Insurance firm and two senior figures handed record data breach fines

This article is more than 6 years old

Fines totalling more than £150,000 handed down over use of private detectives to illegally obtain private banking records

An insurance firm and two senior figures connected with the company have been given record fines for using private detectives to illegally obtain the private banking records of a businessman they were investigating.

The fines, totalling more than £150,000, were described by an official watchdog as the highest ever imposed under the Data Protection Act for unlawfully acquiring personal information.

The sentencing on Friday marks the first convictions from an inquiry by the Information Commissioner’s Office (ICO) into the use of private detectives by companies.

The inquiry, into what has been called “blue-chip hacking”, has centred on claims that companies, including legal, insurance and financial firms, have illicitly acquired confidential personal details of victims.

Michael Woodgate, 67, a businessman who helped to set up the Kent-based loss adjuster Woodgate and Clark Ltd, was fined £75,000 under section 55 of the 1998 Data Protection Act at Maidstone crown court. He stepped down as a director of the firm last year.

The company, which has a turnover of about £13m, was fined £50,000, and Colum Tudball, a 54-year-old senior employee, £30,000.

Two private detectives, Daniel Summers, 38, and John Spears, 78, were fined £20,000 and £10,000 respectively.

Elizabeth Denham, the information commissioner, said: “The illegal trade in personal information is not only a criminal offence but a serious erosion of the privacy rights of UK citizens. As well as these record fines, the organisations and individuals involved also face serious reputational damage as a result of being prosecuted by the ICO.”

The judge, Charles Macdonald QC, said he regarded the offences as “relatively serious”, adding that the motivations behind them were plainly commercial.

The court had heard how Spears, a former police officer, had hired Summers to get the private financial information – knowing that it could only be obtained unlawfully – and paid him £1,675.

In return, Summers acquired details of a mortgage, account balances and loans from two banks, Barclays and Abbey National, in 2005 in what was described as “an illegal fishing expedition”.

These details were passed on to Spears, who in turned shared them with Tudball and Woodgate. They were investigating an insurance claim by Michael Cookson, whose Lancashire nightclub, the Voodoo Lounge, burned down in 2004. They wanted to know if Cookson had enough money to take legal action, according to the ICO.

The ICO told the court that Tudball and Woodgate had turned a blind eye to the obvious fact that the details of Cookson’s finances could not have been obtained legitimately.

Spears was paid £4,000 by Woodgate and Clark Ltd for four emails that contained Cookson’s financial transactions.

The ICO has been investigating an illegal practice known as “blagging”, in which private investigators con employees in banks, call centres and government departments into disclosing information such as addresses or details of bank accounts, tax returns and mortgages.

The blaggers often pretend to be from another part of the organisation and use jargon and internal knowledge of computer systems to make their stories sound plausible.

The ICO’s inquiry into the “blue-chip hacking” began in 2013 following criticism that police had failed to investigate evidence that 98 firms had hired private investigators to obtain personal information illegally from at least 125 victims.

The inquiry is now focusing on prosecuting up to 10 firms. Investigations into the other firms were dropped for various reasons including because they were defunct, outside of the UK, or the evidence was too weak.

Summers was convicted in his absence as he is understood to be in Cyprus. Richard Horwell QC, for the ICO, said: “Efforts have been made to contact Mr Summers. They have failed.” He added that the “reason why he is in Cyprus or what he is doing there” was not known.

More on this story

More on this story

  • Joe Biden has just dealt a big defeat to big tech

  • Farage joins explosion in people using subject access requests

  • Facebook owner Meta fined €1.2bn for mishandling user information

  • Ex-minister predicts ‘battle royale’ over US firm’s bid for NHS data contract

  • Chinese firm got Covid contract despite trying to hack NHS data, minister says

  • Man files complaint accusing YouTube of harvesting UK children’s data

  • Trafficking victim wins landmark victory in Salvation Army data case

  • UK data watchdog to scale back fines for public bodies

  • Home Office’s visa service apologises for email address data breach

  • Cabinet Office fined £500,000 over New Year honours list data breach

Most viewed

Most viewed