In our last Review, we reported on 2 former employees of T-Mobile who illegally obtained and sold lucrative mobile phone contract details owned by their employer to third parties. Following investigations by T-Mobile with the assistance of the Information Commissioner, both employees pleaded guilty and were convicted under the Data Protection Act 1998. The pair were ordered to pay a total amount of £73,700 in fines and confiscation costs.

The case highlights the need for employers and data controllers to have clear policies and processes in place to prevent misuse of personal data and cooperate efficiently with the Information Commissioner in the course of any investigations. In this particular case T-Mobile were able to avoid liability as they had clear policies in place on the protection and retention of personal data and staff had been trained in this area.