Michael Isaacs, 80, from Epsom, Surrey, was the sole director of Datasearch Services Limited (DSS), a firm previously engaged by RBS to trace debtors and assess their assets and repayment capacity.

Concerns were raised by RBS in February 2016 regarding the nature of reports obtained from DSS. This led to a search warrant being executed at Mr Isaacs’ residence, which doubled as his office, resulting in the confiscation of 64 trace reports.

The investigation found that Mr Isaacs was regularly contacting organisations, including utilities companies, local councils, and GP surgeries, by impersonating their customers. Mr Isaacs, using voice-changing software, managed to bypass basic security measures to gather the personal data he required.

The illegitimately collected data included monthly direct debits, bank account details, and outstanding mortgages. This extensive profiling was entirely beyond the remit agreed with RBS.

Mr Isaacs pleaded guilty on 25 February 2022 to six out of the 14 counts of unlawfully obtaining personal data, contravening Section 55 of the Data Protection Act.

His guilty plea triggered proceedings under the Proceeds of Crime Act (POCA), designed to confiscate any assets that are a product of criminal activities. Appearing at Kingston-upon-Thames Crown Court on 15 June for a POCA hearing, the court ordered Mr Isaacs to repay £38,000 under a POCA confiscation order, having profited from his criminal actions.

He was fined a further £10,560 with court costs amounting to £15,000.