Council employee sentenced under CMA for illegally accessing personal data

The Information Commissioner's Office (ICO) has announced that a Herefordshire Council worker who unlawfully accessed hundreds of personal records has been handed a suspended prison sentence at Worcester Magistrates' Court on 17 July. 

Thirty-one-year-old Geoffrey Smith of Ledbury, Herefordshire, carried out the unauthorised access as a new employee in the council's Children and Young People directorate. Over four days, Smith unlawfully accessed approximately 490 records and downloaded 94 documents relating to family members and acquaintances. The data accessed included highly sensitive information such as medical records, social worker reports, and child and family assessments.

Smith was exposed after internal concerns were raised regarding unauthorised access to a referral case, prompting a broader ICO investigation into his activity. On 27 May 2026, he pleaded guilty to an offence under Section 1 of the Computer Misuse Act 1990. Smith was sentenced to two months' imprisonment, suspended for 12 months, ordered to complete 120 hours of unpaid work, and required to pay £2,000 in costs, along with a £154 victim surcharge.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.