Four Days, 490 Records, a Criminal Conviction: When an Employee Goes Rogue

In July, a council worker received a suspended prison sentence for looking up records he had no business reading. The ICO’s account of the case is short, but it carries two lessons: individuals who misuse data can go to prison, and the route there is not the one most people assume.

What happened

Geoffrey Smith was a new employee in Herefordshire Council’s Children and Young People directorate. Over four days he accessed around 490 records and downloaded 94 documents. The records related to his own family and to families he knew, adults and children, and included medical records, social worker reports and child and family assessments. It came to light when concerns were raised within the council about unauthorised access to a referral case, prompting an investigation into what else he had looked at.

He pleaded guilty on 27 May 2026 and was sentenced at Worcester Magistrates’ Court on 17 July to two months’ imprisonment suspended for twelve months, 120 hours of unpaid work, £2,000 in costs and a victim surcharge.

Why the Computer Misuse Act, and not the Data Protection Act

Smith was prosecuted under section 1 of the Computer Misuse Act 1990, unauthorised access to computer material: the provision used against hackers, carrying up to two years’ imprisonment.

Data protection law has its own criminal offence. Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain personal data without the controller’s consent, and the ICO has used it against rogue employees for years. But the maximum penalty is a fine, and in practice the fines are small: in 2024 a car hire trainee who looked up over 200 customer records was fined £265 under section 170. Successive Commissioners have asked for custodial powers and never been given them.

Since 2018 therefore the ICO has increasingly reached for the Computer Misuse Act where the facts allow; the first such prosecution put a vehicle repair employee in prison for six months. The message for anyone with a login to a system holding personal data is that looking up people you know is not just a disciplinary matter. It is the same offence as hacking.

What this means for the controller

Herefordshire Council was the controller of every record Smith accessed, and under the Integrity and Confidentiality Principle and Article 32 of the UK GDPR it was obliged to have appropriate technical and organisational measures to protect them. An employee going rogue does not, on its own, mean those measures failed. The question is whether the controls were appropriate for the data and whether they did their job when tested. No enforcement action against the council has been published, and the ICO’s account suggests why: the misuse was spotted internally, and the investigation could establish which records had been accessed, over what period, and what had been downloaded. That is only possible if access is logged, the logs are kept, and somebody can review them.

Put simply, the controls that protect a controller from enforcement are the same ones that make prosecuting the individual possible. Without the audit trail, the council faces a harder conversation with the ICO and the individual’s defence is stronger.

What good looks like

The records here were children’s social care files: special category data about some of the most vulnerable people a council deals with. For data of that sensitivity, the baseline is clear.

Restrict access to what the role needs.

A new starter should not have had access to 490 records in four days in the first place. Role-based access would have stopped most of them being opened at all. Our piece on designing a least-privilege model sets out how.

Log access, keep the logs, and look at them.

Logging that nobody reviews protects nobody. A high volume of lookups from one account, or access to records with no case connection to the user, should trigger a question. With the growth of AI, screening logs automatically to identify unusual behaviour patterns is becoming easier than ever, providing the appropriate risk assessments have been performed that is. 

Say it explicitly in training and policy.

Most people know not to share data outside the organisation. Fewer know that reading a record they are not working on is itself unlawful. Tell them in writing, and tell them it can mean a criminal record, and it is no good doing this 12 weeks after access to the data has been granted. Data protection training should be delivered before access is granted.

Treat internal misuse as a breach.

Unauthorised access by a member of staff is a personal data breach. It needs the same assessment, notification decision and follow-through as an external attack.

Vicarious liability

Before concluding this blog, one of the most high profile cases in which the Computer Misuse Act was used against an employee was in 2020 when a disgruntled employee, Andrew Skelton, deliberately stole employee data to harm his employer Morrisons Supermarkets. In WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12, the Supreme Court held that Morrisons was not vicariously liable for the deliberate disclosure of employees’ payroll data by Skelton. Although his employment gave him access to the information, he published it online as part of a personal vendetta intended to harm Morrisons. What is crucial to note, is that lower courts found Morrisons’ liable for Skelton’s actions and should pay compensation to the victims affected. The Supreme Court found on the facts of this case that Morrisons was not vicariously liable for the actions of Skelton, however they confirmed that data protection legislation does not, in principle, exclude vicarious liability for an employee’s wrongdoing, meaning that Morrisons would still be liable where the employee’s unlawful processing is sufficiently connected with their employment. It should be noted that although the case was decided under the Data Protection Act 1998 rather than the UK GDPR or Data Protection Act 2028, it remains important guidance on employer liability for deliberate data breaches by staff.

In case you were wondering what happened to Skelton, he was prosecuted separately at Bradford Crown Court in 2015. He was found guilty of fraud and of offences under the Computer Misuse Act 1990 and section 55 of the Data Protection Act 1998, and was sentenced to eight years’ imprisonment.

How Griffin House Consultancy Can Help

Most organisations have good intentions about access control and audit; far fewer have evidence the controls work. We help organisations map who can see what, design access models that match roles rather than convenience, set up logging that would survive scrutiny, and train staff on where the personal line sits. Get in touch with us at Griffin House Consultancy, or call us on 01673 885533.

Author: Mike Martin LLM

Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.