Sunday November 13, 2011 : Punishment doesn't fit the crime
The UK Information Commissioners Office (IC0) has come out strongly against the light sentence handed down by the Hendon Magistrates Court yesterday (Thursday) to a former gambling industry worker who was found guilty of unlawfully obtaining and selling the personal data of over 65 000 online bingo players.
The infringements were first discovered in May 2011 when Marc Ben-Ezra, under the pseudonym Malcolm Edwards, sent a series of e-mails to contacts in the gambling industry offering the customer data for sale and providing a data sample set of 400 Foxy Bingo customers.
Cashcade, Foxy Bingo's customer data controller and marketing service provider, obtained the services of an investigative company who purchased the data for GBP 1700 in cash.
The resulting package contained more than 65 000 Foxy Bingo and 404 Gala Coral customers' personal details. The company turned the information over to the ICO and co-operated fully with investigators to pin the source.
After enquiries were made at an e-mail address traced back to Ben Ezra's father-in-law in August 2011, Ben-Ezra contacted the ICO and co-operated fully telling investigators “that the practice of buying and selling customer data was widespread during his time working in the gaming industry in Israel.” He admitted keeping the data he had obtained whilst in Israel and, on moving to London, sold it to pay off his gambling debts.
Cashcade Limited believe that the acquired test data, which did not contain customers’ bank account details, was unlawfully obtained in 2008 and sold to Ben-Ezra, who was working for a poker company in Israel at the time. Attempts by Cashcade to identify the perpetrators of the 2008 breach have so far been unsuccessful and the company is continuing to pursue the other perpetrators. Gala Coral Group believes its 2008 information was unlawfully lifted from their management system.
Both Foxy Bingo and Gala Bingo have proactively contacted affected customers to assure them that their account information is secure.
Ben-Ezra was given a three-year conditional discharge and ordered to pay GBP 1 700 to Cashcade Limited as well as GBP 830.80 costs at Hendon Magistrates Court.
Information Commissioner, Christopher Graham, said:
“This case shows that the unlawful trade in personal information is unfortunately still a thriving and lucrative activity. Mr Ben-Ezra sold people’s personal details on an industrial scale, making in the region of GBP 25 000 at the expense of the tens of thousands of bingo players whose privacy he compromised, and who he exposed to the nuisance of being approached by rival betting websites and, at worst, the risk of identity theft.
“I am grateful to Cashcade Limited and Gala Coral for their work in exposing this unlawful practice. However, we still don’t have a punishment that fits the crime. The ICO continues to push for the government to activate the 2008 legalization that would allow courts to consider other penalties like community service orders or the threat of prison.”