After an investigation by the Information Commissioner’s Office (ICO), along with the assistance of Enterprise Rent-A-Car, three former employees of Enterprise Rent-A-Car in the U.K. have been sentenced for conspiring to steal customer information that accident claims companies could use to make nuisance calls and sell on as personal injury claims.

Details of tens of thousands of customers from the car rental company were sold for hundreds of thousands of pounds, leading to unlawful contact from “ambulance chasers” making cold calls about personal injury, in a scheme that ran for almost two and a half years, according to a report by the ICO. 

Enterprise Rent-A-Car said in a statement to Auto Rental News that the unauthorized access may have been gained through one of its rental reservation applications in August 2011.

"As a result of this suspicion, we immediately undertook an internal investigation and informed the ICO and police authorities," said John Davies, Enterprise's European corporate communications director. "After uncovering the unauthorized access, we worked closely with the ICO on its investigation. As a business, we will not tolerate any behavior that exposes our customers or threatens our integrity."

Andrew Minty, Jamie Leong, and Michelle Craddock, who at various times worked for Enterprise in Cardiff or Aldershot, all pleaded guilty at England’s Winchester Crown Court on Jan. 4 to conspiracy to commit offences under the Data Protection Act.

Minty was fined 7,500 pounds, which he has to pay within two years or face three months custody. Leong and Craddock, who had less involvement in the conspiracy and had either paid greater amounts of damages or been affected more by previous civil proceedings, were given 12 month conditional discharges but ordered to pay 3,000 pounds and 1,200 pounds in prosecution costs respectively, according to the report.

“Car rental companies have details of drivers who have been in a road accident and need to hire a vehicle whilst theirs is out of action,” said Steve Eckersley, ICO’s head of enforcement. “These details are valuable leads to companies which make money from encouraging accident victims to make claims.”

As well as the criminal proceedings brought by the ICO, Enterprise-Rent-A-Car had previously issued civil proceedings against the defendants. This resulted in the defendants paying the company 400,000 pounds in civil compensation in total between them, says the report.

"Although no customer's bank account or credit card details were compromised as a result of the unlawful activities of these former employees, we treat the theft of customer information extremely seriously," said Davies. "We're pleased to see that bringing this matter to the attention of the ICO, and assisting it with its investigation, has led to these convictions. We hope that this sends out a strong message that Enterprise will not tolerate this behavior and will use all means at its disposal to combat the illegal accessing of customer information."