Info Gov

A former Labour councillor has pleaded guilty to a conspiracy charge involving an offence under the Computer Misuse Act 1990 arising from allegations that a party membership database was unlawfully altered to assist a candidate in a parliamentary selection process, Southwark Crown Court has heard.

Gabriel Leroy, 24, a former councillor in Southend, entered the guilty plea on 16 June 2026. Three co-defendants - Joel Bodmer, 40, his wife Shila Bodmer, 41, and former Croydon councillor Carole Bonner, 69 - pleaded not guilty and will face trial from 5 February 2029. Leroy is unlikely to be sentenced before the trial concludes.

All four defendants were charged with conspiracy to commit an offence contrary to section 1(1) of the Criminal Law Act 1977 and section 3 of the Computer Misuse Act 1990. Section 3 CMA 1990 creates the offence of performing an unauthorised act in relation to a computer with intent to impair the operation of any computer, prevent or hinder access to any program or data, or impair the operation or reliability of any such program or data.

Joel Bodmer faces an additional count of perverting the course of justice. The indictment alleges that he provided a PDF document and a Microsoft Excel file purporting to be his complete telephone records while a call to the Labour Party support team had been deleted from those records. His barrister, Sean Caulfield, indicated that on the computer misuse charge the defence case would be that Bodmer had the authority to act, and on the perverting the course of justice charge that he had no intention to pervert the course of justice.

The selection process for Labour's candidate for Croydon East was abandoned in November 2023 amid allegations that personal details of members on a party database had been altered without authorisation. Back in 2023, Labour Party members in Croydon East filed complaints about their contact details being altered. Somebody had apparently falsified their phone numbers and email addresses. This, in turn, meant that some of the potential parliamentary candidates couldn't vote in the selection process.

The selection was subsequently re-run without Joel Bodmer's participation. Natasha Irons won the re-run selection and was elected as the Member of Parliament for the new Croydon East constituency.

In March 2024, the Metropolitan Police launched its official investigation into the Croydon East allegations. On 21 April 2026, a Metropolitan Police spokesman stated that the Crown Prosecution Service had authorised charges against four people after an investigation by the Met's Cyber Crime Unit into allegations that a Labour Party database was manipulated to increase a candidate's chances of selection in Croydon.

Joel Bodmer is a Unison organiser and was vice-chair of London TULO at the time of the alleged offences. A Unison spokesperson confirmed he is an employee of the union and is currently on unpaid leave.

Frank Ferguson, head of the Crown Prosecution Service's Special Crime and Counter Terrorism Division, said when charges were announced in April 2026: "Our prosecutors have worked to establish that there is sufficient evidence to bring this case to court and that it is in the public interest to pursue criminal proceedings. We have worked closely with the Metropolitan Police Service as it has carried out its investigation.

"We remind all concerned that criminal proceedings against these defendants are active and that they have the right to a fair trial. It is vital that there should be no reporting, commentary or sharing of information online which could in any way prejudice these proceedings."

A Labour Party spokesperson said: "These are incredibly serious charges. When complaints were first raised with the Labour Party we conducted a thorough internal investigation and we referred the matter to the police as soon as potential criminal wrongdoing was identified. We cannot comment further while legal proceedings are ongoing." All four defendants remain suspended from the Labour Party.

Political party membership databases sit outside the regulatory perimeter of the ICO in important respects but are nonetheless subject to the full application of the UK General Data Protection Regulation and the Data Protection Act 2018.

Political parties process substantial quantities of personal data in the course of managing their memberships and conducting internal selection processes, including contact details, voting eligibility records, and communications histories. The alleged conduct - the unauthorised alteration of members' names, addresses, telephone numbers and email addresses in a party database - would, if proved, constitute a serious breach of the integrity principle under Article 5(1)(f) UK GDPR, which requires that personal data be processed in a manner that ensures appropriate security against unauthorised or unlawful processing.

The allegation that individual members were effectively disenfranchised in the selection process as a result of their contact details being falsified would also engage the question of whether the party, as controller, maintained adequate technical and organisational measures under Article 32 to prevent such interference.

The Computer Misuse Act (CMA) charges address the criminal dimension of the alleged database interference directly. Section 3 CMA 1990 targets unauthorised modification of computer material with intent to impair, a provision designed for cases where data integrity is deliberately compromised. The allegation concerning Bodmer's telephone records engages both section 3 and the separate common law offence of perverting the course of justice.

The involvement of the Met's Cyber Crime Unit, and the referral of the case to the CPS's Special Crime and Counter Terrorism Division (the division that handles the most serious and sensitive criminal matters) reflects the gravity with which the authorities approached what might superficially appear to be an internal party administrative dispute.

Also in this section

Jun 24, 2026

ICO EdTech audit finds widespread compliance failures in children's data handling

A programme of consensual audits carried out by the Information Commissioner's Office has identified systemic data protection failings across the UK education technology sector, with nearly 70 per cent of providers found to be acting as controllers over children's personal data without recognising or fulfilling that role.
Jun 23, 2026

The New Data Protection Complaints Regime

From Friday, 19 June 2026, organisations can no longer rely on complaints going straight to the ICO. The Data (Use and Access) Act 2025 introduces a new regime requiring them to receive, investigate and resolve data protection complaints themselves. Maggie Burns and Charlotte Smith explain what you need to know.
Jun 15, 2026

New statutory complaints duty comes into effect this week

From Friday 19th June, the requirement for all public authorities that process personal data to operate a formal internal complaints process for data protection issues, comes into force under a new duty inserted into the Data Protection Act 2018 by the Data (Use and Access) Act 2025.

InfoGov Masthead Newsletter 800