Data Protection – Loss Adjuster Guilty Verdict

Guilty verdicts in trial against a company and rogue private investigators

With data protection in the forefront of everyone’s minds, and the looming GDPR requirements, this case will send shock waves through the loss adjusting community.  The company and two of it’s Directors have been handed guilty verdicts by a jury in relation to illegally obtaining and then passing on, information in relation to private bank details of individuals involved in their investigations.

It is worth reminding ourselves of the principles governing the actions of Data Controllers and Processors under the current DPA 1998 rules

Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

• fairly and lawfully processed;
• processed for limited purposes;
• adequate, relevant and not excessive;
• accurate and up to date;
• not kept for longer than is necessary;
• processed in line with your rights;
• secure; and
• not transferred to other countries without adequate protection.

Lessons to be learnt must be to be very careful about the types of information you request, be clear about what you are requesting it for and be clear about if you can lawfully process or use that information in your investigation!  If the information is not relevant, you do not have the subject’s consent, and disclosing it would breach the rights of the subject, likelihood is you are committing a criminal offence.  Sanctions include fines and prison sentences.

Clearly the jury thought the company had overstepped the mark in this case.  The court is waiting for monetary reports and sentencing has been deferred until the 5th January 2018, we await the outcome with interest.

Read the ICO summary here