"This outcome demonstrates justice did not end at sentencing," said Andy Curry, head of investigations at the Information Commissioner’s Office (ICO).
The individuals: Debbie Okparavero and Maliha Islam
Two former RAC employees — Debbie Okparavero, of Salford, and Maliha Islam, of Manchester — were convicted in 2024 of offences under the Computer Misuse Act 1990 and the Data Protection Act 2018 after selling the personal data of car crash victims. Both were sentenced to six-month prison terms suspended for 18 months and ordered to complete 150 hours of unpaid work.
How the activity was detected: RAC monitoring and WhatsApp messages
RAC deployed unspecified monitoring software that flagged Okparavero copying data from RAC systems. An internal review and subsequent investigation found that about 29,500 lines of personal data were shared with Islam via WhatsApp. The ICO reported that the pair discussed the data and its sale in a WhatsApp chat, and that the dataset amounted to "just shy of 30,000 lines of data" sold to an unknown buyer.
Legal and financial consequences imposed by courts and the ICO
The criminal convictions were followed by financial orders under the Proceeds of Crime Act. Islam was ordered in November to repay £39,522.50 (reported as $48,274.45) and the ICO noted she has paid that amount in full. At Manchester Crown Court on May 29, Okparavero was ordered to repay £89,277.32 (reported as $119,962.38) within three months; failure to meet that order will result in her serving 18 months in prison. Together, the duo must repay more than £118,000 ($158,500) collectively, the ICO said.
ICO enforcement approach and message to reporting organisations
Andy Curry framed the repayments as an extension of criminal justice into financial recovery: "Our powers enabled us to continue to pursue these two individuals in order to strip them of assets gained through their serious criminal activity. Through the Proceeds of Crime Act, we are ensuring people do not financially benefit from their criminal activity." Curry also publicly thanked RAC "for informing us about this breach and fully supporting the ICO’s investigation, which enabled us to hold these two individuals to account."
How RAC, the ICO, and crash victims are affected
- RAC: The company’s deployment of monitoring software led to detection of internal copying and to notifying the ICO; RAC’s cooperation was explicitly acknowledged by the regulator as instrumental in the investigation.
- The ICO: The office not only pursued criminal charges but used Proceeds of Crime powers to seek repayment and strip financial gains, and it publicly credited inter-agency enforcement as part of the outcome.
- Crash victims: Personal data belonging to car crash victims formed nearly 29,500 lines of information that were transferred via WhatsApp and sold to an unknown third party, meaning those individuals’ data exposure was both internal and transacted outside RAC systems.
The case closes with a practical endpoint and a clear conditional: Islam has satisfied her repayment order; Okparavero has three months from the May 29 court order to pay £89,277.32 or face 18 months behind bars. As Andy Curry put it, the legal process extended from conviction into financial recovery — and the immediate, measurable impact rests on whether the final repayment is made and on how the victims of the data sale learn of and recover from the exposure of their information.
