Communications company T-Mobile acknowledged Tuesday that its clients' personal information had been leaked to others — and millions of customer records could be involved, according to Britain's information watchdog.
Information Commissioner Christopher Graham said the records were sold to rival phone companies for profit, calling the case a serious breach of data privacy.
T-Mobile UK Ltd. said it alerted Graham's office when it found that one of its employees passed on customers' contract renewal information to "third parties" without its knowledge.
The information, which included customers' contract expiry dates, were sold to several rivals, which then used the material to cold-call customers to offer them alternative deals, Graham's office said.
"The number of records involved runs into the millions, and it appears that substantial amounts of money changed hands," the government body said in a document submitted to the Ministry of Justice.
Graham said his office was considering the evidence and preparing to prosecute those responsible.
The Data Protection Act prohibits the selling on of data without prior permission from the customer. Offenders could be fined thousands of pounds (dollars), but Graham said the existing penalties fail to deter offenders.
"The existing paltry fines ... are simply not enough to deter people from engaging in this lucrative criminal activity. The threat of jail, not fines, will prove a stronger deterrent," he said.