T-Mobile at centre of illegal data sale investigation

Employees at T-Mobile’s UK operation have been identified as the culprits in the illegal sale of subscriber data affecting “many thousands of customers”.

UK privacy watchdog the Information Commissioner’s Office (ICO) launched a criminal investigation after a mobile telephone company – since revealed to be Deutsche Telekom owned T-Mobile – discovered that some its employees allegedly sold details relating to customers’ mobile phone contracts, including their expiry dates.

The information was allegedly sold on to T-Mobile’s competitors – which might be rival operators Vodafone, O2, Orange, or 3, or any number of third party brokers which were using the material to cold call customers prior to contract expiry dates to offer them an alternative contract – but at the moment the ICO is not saying how far its investigation will extend.

“The ICO has investigated and it appears that the information has been sold on to several brokers and that substantial amounts of money have changed hands. The ICO has obtained several search warrants and attended a number of premises, and is now preparing a prosecution file.”

According to our legal sources, this sort of thing is a legal grey area. If a company is buying this sort of data then it’s obliged to check that that the data was sourced legitimately.  But if the data passed through quite a few hands, like it may have in this case, an operator’s data controller could have asked the broker they bought the data from if it was legitimately sourced by way of covering itself.

But Information Commissioner Christopher Graham is using the incident as a platform to highlight the “existing paltry fines” for such offences and call for a greater deterrent in the form of a “custodial sentence” to better stop the unlawful trade in personal information.

Graham is backing the government’s proposal to introduce a custodial sentence for so called breaches of Section 55 of the Data Protection Act from April 1, 2010.

“We are considering the evidence with a view to prosecuting those responsible and I am keen to go much further and close down the entire unlawful industry in personal data. But, we will only be able to do this if blaggers and others who trade in personal data face the threat of a prison sentence,” Graham said.

“More and more personal information is being collected and held by government, public authorities and businesses. In the future, as new systems are developed and there is more and more interconnection of these systems, the risks of unlawful obtaining and disclosure become even greater. If public trust and confidence in the proper handling of personal information, whether by government or by others, is to be maintained effective sanctions are essential.

“A custodial sentence will also have the added benefit of making the section 55 offence a recordable one and open up the possibility of extradition in appropriate cases,” he said.

T-Mobile

How does this article affect your perception of T-Mobile? What is this?

T-Mobile is 16.2% negative

Total votes: 43

33 18 43 2594f8cb39 0

An investigation by the ICO revealed that Carphone Warehouse and sister company TalkTalk had been opening customer accounts in the wrong name and passing inaccurate information on to credit reference agencies and debt collection agencies.

Security failings also led to customers being able to view other user account details online and the retailer also failed to respond to requests by individuals on information held about them.

The ICO has now ordered Carphone Warehouse and TalkTalk to improve their data protection practices or face prosecution for failing to meet the basic principles of the Data Protection Act.

Mick Gorrill, assistant commissioner at the ICO, said: “The Data Protection Act gives us all important rights, including the right to correct inaccurate information and to find out what information an organisation holds on us. Organisations that process personal information must comply with the Act and, where we find that this is not the case, the ICO will take enforcement action.

“Carphone Warehouse and TalkTalk’s use of inaccurate and incorrect personal data has caused real damage and distress to customers,” Gorrill said.