The story begins at the RAC's call centre in Stretford, Greater Manchester, where Debbie Okparavero, 61, of Salford and Maliha Islam, 51, of Manchester, worked as customer service specialists handling calls from people who had been in accidents. At some point they began copying the personal information those callers provided — names, addresses, contact details, circumstances of their accidents — and selling it to an unknown third party. Just under 29,500 lines of data were taken. The buyer has never been publicly identified.
The scheme unravelled when the RAC installed new security monitoring software. The software flagged Okparavero accessing and copying records she had no legitimate business reason to touch. A search of her mobile phone produced a WhatsApp chat with Islam in which the pair discussed the data and its sale. Messages indicated the third party was paying them for the information.
The RAC reported the matter to the Information Commissioner's Office. Both women pleaded guilty to conspiracy to commit offences under the Computer Misuse Act 1990 and the Data Protection Act 2018. At Minshull Street Crown Court on 8 October 2024, each received a prison sentence of six months, suspended for 18 months, and was ordered to complete 150 hours of unpaid work.
That was not the end of the legal process.
On 29 May 2026, at Manchester Crown Court, Okparavero was ordered to pay £85,727.32 under the Proceeds of Crime Act, plus costs of £3,550, a total of £89,277.32. If she does not pay within three months, she will serve 18 months in prison and remain liable for the full amount regardless. At a separate hearing in November 2025, Islam was ordered to pay £33,125 plus costs of £2,797.50. Islam has already paid in full.
Like this? Get the app: iOS | Android
Andy Curry, the ICO's head of investigations, was direct about what the outcome was intended to demonstrate:
"This outcome demonstrates justice did not end at sentencing. Our powers enabled us to continue to pursue these two individuals in order to strip them of assets gained through their serious criminal activity. Through the Proceeds of Crime Act, we are ensuring people do not financially benefit from their criminal activity."
The ICO also acknowledged the RAC's role:
"I would like to once again thank the RAC for informing us about this breach and fully supporting the ICO's investigation, which enabled us to hold these two individuals to account."
The type of data that was taken matters. People who call the RAC following an accident are often in distress, dealing with injury, vehicle damage or the immediate aftermath of trauma. The information they provide — name, address, details of what happened and where — is exactly what ambulance chasing law firms, claims management companies and unscrupulous repair shops pay for. Someone paid Okparavero and Islam for it. That buyer has not been identified or prosecuted. The 29,500 people whose details were sold have no way of knowing whether their information reached anyone or what was done with it.
The ICO's use of POCA proceedings following a criminal conviction is not routine, and the office has been deliberately expanding its enforcement posture in this direction. Sentencing alone leaves the financial benefit of the crime intact. Stripping it through confiscation orders is a different kind of consequence, aimed at ensuring the criminal activity was not economically rational in the first place. For a criminal justice system in which the sentence is frequently suspended and unpaid work is the practical outcome, it is also a deterrent with teeth that sentencing alone does not always provide.
For anyone whose personal data has been taken and sold without their knowledge, the £118,000 recovered does not undo the original breach. It does, at least, leave the people who caused it substantially worse off than if they had simply answered the phones.
Sources
- ICO press release (primary source) — Success in securing over £118,000 in confiscation orders against two former RAC employees, 4 June 2026
- ICO enforcement page — Debbie Okparavero and Maliha Islam
- ICO press release (sentencing, 2024) — Criminal record and suspended prison sentence handed to former RAC employees
- The Register — Duo who sold car crash victims' data must repay £118k
- Infosecurity Magazine — Former RAC Employees Get Suspended Sentence for Data Theft
