Barclays Bank employee prosecuted for illegally accessing customer’s account
A former Barclays Bank employee has been fined pounds 3,360 after illegally accessing the details of a customer’s account. In one case the employee, Jennifer Addo, found out the number of children the customer had and passed the details to the customer’s then partner, who was a friend of Ms Addo.
Appearing at Croydon Magistrates Court today, 27-year-old Ms Addo was prosecuted under section 55 of the Data Protection Act and fined pounds 2,990 for 23 offences and ordered to pay a pounds 120 victim surcharge and pounds 250 prosecution costs.
The bank was alerted to Ms Addo’s activities when the customer contacted the bank to report that information from his account appeared to have been passed to his then partner. An investigation was launched by the bank that discovered Ms Addo had illegally accessed the customer’s details on 22 occasions between 10 May 2011 and 8 August 2011. This was despite Barclays informing its staff that they should not access customers’ accounts unless required.
When interviewed by her employer, Addo confirmed that she was aware that the complainant’s details should not have been accessed, but still decided to look at the complainant’s file and pass information to her friend. Ms Addo failed to respond to the ICO’s enquiries leading up to today’s prosecution.
ICO Head of Enforcement, Stephen Eckersley, said:
‘The banking industry has rigorous procedures and safeguards in place to make sure customers’ details are kept secure. However banks rely on the honesty and professionalism of their staff to ensure that the privileged access given to their records is not abused for personal gain.
‘Jennifer Addo knew she was breaking the law by inappropriately accessing the complainants’ details and passing information to a third party but still decided to act. She is now facing the consequences of her actions.
‘This case proves, yet again, why we need a more appropriate penalty for the crime of personal data theft. With the law as it stands, this prosecution isn’t even recorded on the police national computer which means that an offender could apply for a job in a high street bank tomorrow and the potential employer wouldn’t be informed about the offence. The current ‘fine only’ regime is clearly not deterring people from breaking the law.’
Unlawfully obtaining or accessing personal data is a criminal offence under section 55 of the Data Protection Act 1998. The offence is punishable by way of ‘fine only’ – up to pounds 5,000 in a Magistrates Court or an unlimited fine in a Crown Court. The ICO continues to call for more effective deterrent sentences, including the threat of prison, to be available to the courts to stop the unlawful use of personal information.
Ms Addo’s employment at Barclays Bank was terminated shortly after the complaint was raised.
Citations:
[2013] UKICO 2013-38
Links:
Jurisdiction:
England and Wales
Information
Updated: 09 July 2022; Ref: scu.528628