In a landmark case marking the Financial Conduct Authority’s (FCA) first-ever prosecution under the Data Protection Act, a former Virgin Media O2 employee has been convicted for unlawfully obtaining and disclosing personal data used to fuel a £1.5 million investment scam.

Luke Coleman pleaded guilty to unlawfully obtaining and selling confidential customer data to his friend Nicholas Harper. The data was then exploited by Harper and accomplices in a “boiler room” crypto fraud that defrauded at least 65 investors.

Between 2017 and 2019, Coleman accessed customer details from Virgin Media O2’s systems and passed them on to Harper, who used them to cold-call victims and lure them into fake investment schemes. Two other individuals, Raymondip Bedi and Patrick Mavanga, were later jailed for a combined 12 years for their role in the fraud.

Coleman was fined £384, ordered to pay a £38 surcharge, and contribute £500 in prosecution costs, the maximum penalty available for this type of offence.

A first for the FCA

The case is significant not for the size of the fine, but for what it represents. As Steve Smart, the FCA’s executive director of enforcement and market oversight, stated, “Coleman abused his position of trust and enabled others to commit crimes which led to huge financial and emotional consequences for victims. This is our first prosecution under the Data Protection Act. Going forward, those who enable crime should be clear that we will use all of our powers to hold them to account.”

While data protection enforcement is typically the domain of the Information Commissioner’s Office (ICO), the FCA’s decision to prosecute signals a major shift in how financial regulators are prepared to tackle misuse of personal data that facilitates financial crime.

What this means for businesses

This case sends a strong message to organisations across all sectors that data protection breaches are no longer just a privacy issue. They are a financial crime risk.

Key takeaways for businesses:

• Expanded regulatory reach: The FCA has demonstrated it will not hesitate to use data protection powers where customer information is misused to commit or enable financial misconduct. This broadens the scope of accountability beyond traditional ICO enforcement. 
• Employee trust and insider risk: Coleman’s actions underscore how insider access to personal data remains one of the biggest data protection threats. Businesses must ensure robust internal controls, access monitoring, and staff training. 
• Cross-regulatory implications: Firms regulated by both the FCA and the ICO should anticipate greater cooperation between regulators on data misuse cases, particularly where breaches facilitate fraud or market abuse. 
• Compliance culture under scrutiny: The case reinforces that data protection compliance is inseparable from financial integrity and ethical conduct. Weaknesses in handling personal data can directly expose firms to criminal liability and reputational damage. 

While the fines imposed in this case are modest, the reputational and legal consequences for Coleman as well as the message sent by the FCA, are far-reaching. It establishes a precedent that the regulator will not treat personal data misuse as a peripheral issue. This is a turning point in data protection enforcement, aligning it more closely with financial regulation and corporate accountability. Businesses should see this as a cue to review their data governance frameworks, staff vetting procedures, and insider threat controls before regulators come knocking.

The FCA’s first prosecution under the Data Protection Act is more than symbolic. It’s a warning. Data misuse that enables fraud will be pursued not just by the ICO, but by financial regulators too. Firms must ensure their data protection and compliance frameworks are aligned, robust, and proactively enforced.

Vinciworks’ new conversational learning course on data protection’s rights and responsibilities puts you at the heart of data protection, turning policy into practical action. Guided by AI-powered experts, it explores how personal data should be handled, shared and stored through realistic workplace scenarios. Try it here.