All news
Gambling Worker Found Guilty of Selling Customer Information
November 30, 2011
A recent news release highlights the ease with which data can be compromised by employees of an organization. The UK Information Commissioner’s Office reported that former gambling industry worker Marc Ben-Ezra has pleaded guilty to unlawfully obtaining and selling personal data relating to more than 65,000 online bingo players. According to the news release, unlawfully obtaining or accessing personal data in the UK is a criminal offence under section 55 of the Data Protection Act 1998. The offence is punishable by way of a financial penalty of up to $5,000 in a Magistrates Court or an unlimited fine in a Crown Court.
According to the news release, the offences were first uncovered in May 2011 after Ben-Ezra e-mailed a number of contacts within the UK gaming industry and offered to sell them Foxy Bingo customer data. Upon learning of the sale, Cashcade Limited, which is the data controller for Foxy Bingo’s customer information was concerned and launched an investigation.
Cashcade Limited engaged an investigative services company to conduct a test purchase of the data and paid Ben-Ezra $1,700 for the information. The data acquired contained, as well as customer information relating to 404 Gala Coral customers from 2008. After the transaction, Cashcade turned over its finding to the Commissioner’s office.
Further investigation exposed Ben-Ezra as the individual behind the offences in August 2011. He ultimately admitted the offences, turned over the laptops containing the data, and cooperated with the authorities. He further commented that the practice of buying and selling customer data was widespread during his time working in the gaming industry in Israel.
“This case shows that the unlawful trade in personal information is unfortunately still a thriving and lucrative activity,” said Information Commissioner Christopher Graham. “Mr Ben-Ezra sold people’s personal details on an industrial scale, making in the region of £25,000 [33,699 USD] at the expense of the tens of thousands of bingo players whose privacy he compromised, and who he exposed to the nuisance of being approached by rival betting websites and, at worst, the risk of identity theft.”
Although it is difficult to protect against data loss caused by employees, there are steps that can be taken – some within the context of the information governance structure itself, and some technical solutions. ARMA International’s GARP® Principle of Accountability highlights the importance of establishing and enforcing policies that outline the organization’s expectations of its employees in the area of handling records and information. Employees can be held accountable if the expectations are clearly outlined.
From a technical perspective, the GARP® Principle of Protection calls for organizations to protect their data through the use of monitoring systems that reveal when data in particular systems is exported from the system. Such actions are often a sign that employees are mis-handling data.
More information on the GARP® principles can be found at www.arma.org/garp.
Diane Carlisle
NewsWire
