'No action' fear over bank data

6:26pm Thursday 28th August 2008

Comments (6)   Have your say »

An Oxford University IT manager who inadvertently bought a computer containing a million people's bank details from Internet auction site ebay fears the whole matter will be "swept under the carpet".

Andrew Chapman sparked a nationwide security alert when he discovered the financial details on a computer server he bought from the website.

Names, addresses, bank details, sort codes, phone numbers, mothers' maiden names and signatures were found on one of two servers he bought for £71.77 from an ex-employee of electronic data storage company Graphic Data.

The Information Commissioner's Office, the UK's independent information watchdog, has vowed to investigate the matter urgently.

But the 56-year-old, from Seacourt Road, Botley, said the Commisioner had not accepted his offer to hand in the server so officials could examine it.

Mr Chapman said: "What I hope doesn't happen is that Graphic Data say it was all a regrettable one-off and the Information Commissioner's Office does nothing.

"I think it will be swept under the carpet, because the ICO has no powers to do anything."

The server contained information about American Express, NatWest Bank and Royal Bank of Scotland customers.

Mr Chapman said he stalled Graphic Data's attempts to get the computer back until he spoke to an ICO investigator, who made no commitment to take hold of the server.

He later exchanged phone calls with Essex-based Graphic Data and also received an email, which told him the server was stolen, so he decided to return it.

It has since emerged that it had not been stolen.

He was instructed to hand the hardware back to an employee in a black Audi - and even told check the registration of the car before giving the computer equipment back on Tuesday evening.

An ICO spokesman said investigators were more concerned with the circumstances leading to the data being leaked than getting hold of the equipment itself.

She said: "We're very concerned about the data breach. It is still very much an active investigation."

She added the ICO had the power to issue enforcement notices and prosecute if it found evidence the Data Protection Act had been breached.

But Mr Chapman said: "I think the present laws are completely ineffective."