The information commissioner has repeated calls for stronger sentencing powers for data thieves.

Christopher Graham (pictured) said it was ‘more important than ever’ that courts had ‘more effective deterrent penalties than just fines’ in an announcement posted on the Information Commissioner’s Office website.

Graham’s comments come after an employee of a car rental company was fined £1,000, for stealing customer information that accident claims companies could use to make nuisance calls.

According to the announcement, Sindy Nagra, who was an administrative assistant at Enterprise Rent-A-Car, sold almost 28,000 customers’ records for £5,000.

Appearing at Isleworth Crown court on Friday, Nagra was also ordered to pay a £100 victim surcharge and £864.40 prosecution costs.

The 42-year-old from Hayes was responsible for processing customer details sent to the car rental company by an insurance company.

Enterprise Rent-A-Car contacted the ICO after its systems identified Nagra looking at a large number of records, including many that she would not have been expected to process.

According to the announcement, Nagra pleaded guilty to unlawfully obtaining, disclosing and selling personal data, which is a criminal offence under section 55 of the Data Protection Act.

The ICO said the court can issue unlimited fines for the offence but not custodial sentences.

Graham said: ‘Nuisance-call cowboys and claims-market crooks will pay people to steal personal data. The fines that courts are issuing at the moment just don’t do enough to discourage would-be data thieves.’

Graham said the fine highlighted the courts’ ‘limited options’.

‘Sindy Nagra got £5,000 in cash in return for stealing thousands of people’s information. She lost her job when she was caught, and has no money to pay a fine, and the courts have to reflect that,’ he said.

‘But we’d like to see the courts given more options: suspended sentences, community service, and even prison in the most serious cases.’

Graham said people who broke the criminal law by trading in other people’s personal information ‘need to know that they will be severely punished and could even go to prison.

‘We’ve been pushing for this for some time. Parliament voted for it to happen more than seven years ago but it remains on a Westminster backburner. It is high time that changed.’

The ICO’s announcement states that the records were bought by Iheanyi Ihediwa, 39, from Manchester, who Nagra claimed had been introduced to her after he approached her husband in a pub.

Ihediwa pleaded guilty to section 55 offences at Manchester magistrates’ court on 17 December. He was fined a total of £1,000, ordered to pay prosecution costs of £864.40 and a victim surcharge. The court made a destruction order in respect of any data held by Ihediwa.