A case in which an abusive husband was able to track down his ex-partner’s whereabouts through her parents’ medical records is cited by the Information Commissioner, Richard Thomas, in a new report on the illegal trade in personal information.
Thomas calls for tougher penalties for people convicted of buying and selling personal information illegally, including prison sentences of up to two years.
He makes his case in the report, What Price Privacy? which cites the advent of large government IT systems, including those planned for the NHS, as drivers for the change in the law.
“We cannot sensibly build an information society unless its foundations and its systems are secure. Plugging the gaps becomes ever more urgent as the government rolls out its programme of joined-up public services and joined up computer systems under the banner of transformational government,” writes Thomas in the foreword to the report.
“However laudable the aim we need to make sure that increasing access to government-held information for those with a legitimate need to know does not also open the door to those who seek to buy, beguile or barter their way to information that is rightly denied to them by law.”
The report highlights two main ways that information is obtained illegally: by paying someone to disclose information which he or she can access or by ‘blagging’ – impersonating someone else to obtain information.
In the health service case cited by the commissioner, a private investigator had been engaged by a potentially abusive husband to track down his estranged wife, after the woman had determined to escape his campaign of harassment and start a new life with her daughter.
The report says: “Introducing himself as an official from the local health authority, the investigator had obtained details of the woman’s whereabouts by telephoning her parents’ medical centre and requesting their telephone number to check a prescription.”
A prosecution was brought by the Information Commissioner but the report points out that currently offences against the Data Protection Act are punishable by a fine only of up to £5000 in the magistrate’s courts and without limit in the Crown Court.
Another case cited in the report included a success for NHS security. A private investigator was attempting to obtain the personal information of a woman who was a vital prosecution witness in a prolonged police inquiry. A bogus ‘doctor’ telephoned the woman’s medical centre claiming that her records were needed by a psychiatric unit in a London hospital but no details were disclosed.
The types of information most commonly sought illegally include current addresses, details of car ownership, ex-directory telephone numbers or records of calls made, criminal records and bank account details.
The report says that main markets for information lie with the media, especially some newspapers; insurance companies, lenders and creditors, including local authorities chasing council tax arrears; people involved in matrimonial and family disputes and criminals intent on fraud, or seeking to influence jurors, witnesses or lawyers.
Link