Burglary: Car rental company convicted of data theft

A man who unlawfully gained access to personal data of Enterprise Rent-A-Car drivers in order to make personal injury claims and gain financial gain has been convicted following an investigation by the Information Commissioner’s Office.

Jonathan Riches, 46, pleaded guilty at Cardiff Crown Court to breaching section 55 of the Data Protection Act 1998. The offences were committed between 2009 and 2011.

Her Honour Judge Francis imposed a fine of £10,000 plus costs of £1,700.

Riches was previously employed by Enterprise Rent-A-Car, but left the company in 2009 to start his own personal injury law firm. He remained in contact with former colleagues and illegally obtained the data of traffic accident victims and then offered them legal services.

At one point, Riches, through his accomplices, had access to Enterprise’s internal database and was thus able to obtain customers’ personal data.

He had previously been ordered to pay £300,000 in civil compensation to Enterprise Rent-A-Car. He was then interviewed by the ICO’s criminal investigation team the following year. He was first summoned to court in 2016, but he failed to appear and fled to the US, where a warrant was issued for his arrest. He returned earlier this year and turned himself in to the authorities.

Andy Curry, head of ICO investigations, said: “We are pleased that justice has been done in this case. Riches led a brazen operation in which his accomplices illegally accessed Enterprise Rent-A-Car’s systems to steal data which he then used to enrich himself to the tune of hundreds of thousands of pounds.

“His scheme, which involved the unauthorized use of people’s personal information, was not only illegal, but also resulted in people receiving annoying phone calls asking if they wanted to make a claim for personal injury damages.

“The verdict announced today is a testament to justice in this case, even though the prosecution and sentencing were delayed for a significant period of time by the defendant’s flight to the United States.

“We would like to thank Enterprise Rent-A-Car for notifying the ICO of the breach as soon as they became aware of it. This is due to the steps they have put in place to prevent and reduce crime. We would also like to thank them for their cooperation in this case.”

Riches’ accomplices in the crimes, Jamie Leong, Michelle Craddock and Andrew Minty, have all been sentenced. The judge told Riches it was an elaborate and long-term arrangement that involved a cynical breach of trust. The judge ruled that the sum must be paid within 12 months or face a nine-month prison sentence.

Riches is certainly not the first Enterprise Rent-A-Car employee to be accused of data theft. In 2014, boss Stephen Siddell was fined just over £800 for stealing the data of 2,000 customers.

Wirral District Court heard how the “greedy” 29-year-old stole the data of customers – who had been involved in accidents while renting cars – and sold it to a claims settlement company.

Related Posts
Former RAC employee caught red-handed with car accident data
Eight Britons face trial over alleged car accident data ring
Data thief escapes prison sentence but must repay £25,000 or face
Jailed car crash data thief must repay £25,500
Six months in prison for data thief after car accident
Fired and punished: Another warning to potential data thieves