Enforcement action

Southend-on-Sea City Council

17 October 2024, Reprimands, Local government

We issued a reprimand to Southend-on-Sea City Council in Essex after hidden data on a spreadsheet released as part of a freedom of information request revealed the sensitive personal details of staff

An ICO investigation revealed that Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting in 66,793 complaints – 93% of these stating there was no ‘opt out’ option. During the investigation, the ICO found that the company had purchased personal information from third-party suppliers that did not obtain valid consent. This led to the ICO issuing Quick Tax Claims Limited with a £120,000 fine.

Quick Tax Claims Limited

15 October 2024, Monetary penalties

An ICO investigation revealed that Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting in 66,793 complaints – 93% of these stating there was no ‘opt out’ option. During the investigation, the ICO found that the company had purchased personal information from third-party suppliers that did not obtain valid consent. This led to the ICO issuing Quick Tax Claims Limited with a £120,000 fine.

National Debt Advice Limited

14 October 2024, Enforcement notices, Finance insurance and credit

National Debt Advice sent 129,902 unsolicited direct marketing text messages to individuals in breach of regulation 22 of PECR resulting in over 4,000 complaints to the 7726 spam reporting service. The company was fined £30,000 and issued with an enforcement notice.

National Debt Advice Limited

14 October 2024, Monetary penalties, Finance insurance and credit

National Debt Advice sent 129,902 unsolicited direct marketing text messages to individuals in breach of regulation 22 of PECR resulting in over 4,000 complaints to the 7726 spam reporting service. The company was fined £30,000 and issued with an enforcement notice.

Levales Solicitors LLP

11 October 2024, Reprimands, Legal

Reprimand issued to Levales Solicitors LLP (‘Levales’) in respect of Articles 32(1)(b) and 32(1)(d). A threat actor accessed Levales’ cloud-based server using legitimate credentials and subsequently published data on the dark web. The incident affected 8,234 UK individuals, of which 863 individuals were deemed at high risk because of the nature of the data involved. The investigation found Levales were not ensuring the ongoing confidentiality of its processing systems and did not implement appropriate organisational measures.

WerepairUK Ltd

10 October 2024, Enforcement notices, Marketing

WerepairUK Ltd made 42,688 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £80,000 and issued with an enforcement notice.

WerepairUK Ltd

10 October 2024, Monetary penalties, Marketing

WerepairUK Ltd made 42,688 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £80,000 and issued with an enforcement notice.

Service Box Group Limited

10 October 2024, Monetary penalties, Marketing

Service Box Group Limited made 5,361 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £40,000 and issued with an enforcement notice.

Service Box Group Limited

10 October 2024, Enforcement notices

Service Box Group Limited made 5,361 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £40,000 and issued with an enforcement notice.

Police Service of Northern Ireland

03 October 2024, Monetary penalties

The Police Service of Northern Ireland has been fined £750,000 for infringing Articles 5(1)(f), 32(1) and (2) of the UK GDPR between 25 May 2018 and 14 June 2024.

Bonne Terre Limited t/a Sky Betting and Gaming

17 September 2024, Reprimands, Online technology and telecoms

We issued a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing people’s data through advertising cookies without their consent.

The Labour Party

28 August 2024, Reprimands, Political

The Labour Party were issued with a reprimand for failing to respond to people’s request for their own personal data, also know as a subject access request, and for failing to respond to peoples request for erasure.

Coastal Windows & Conservatories (UK) Limited

15 August 2024, Enforcement notices, Retail and manufacture

Coastal Windows & Conservatories Limited made over 18,000 unsolicited marketing calls between 1 January and 1 June 2023 to numbers registered with the TPS. The ICO and TPS received numerous complaints from people variously saying they had not consented to receiving such calls or received repeated calls despite requests to stop.

Coastal Windows & Conservatories (UK) Limited

15 August 2024, Monetary penalties, Retail and manufacture

Coastal Windows & Conservatories Limited made over 18,000 unsolicited marketing calls between 1 January and 1 June 2023 to numbers registered with the TPS. The ICO and TPS received numerous complaints from people variously saying they had not consented to receiving such calls or received repeated calls despite requests to stop.

The Electoral Commission

30 July 2024, Reprimands, Central government

Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately 40,000,000 individuals, and the initial access was gained via several unpatched software vulnerabilities. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.

Chelmer Valley High School

22 July 2024, Reprimands, Education and childcare

Chelmer Valley High School have been issued a reprimand in respect of Article 35(1). The school failed to complete a Data Protection Impact Assessment (DPIA) prior to introducing facial recognition technology for the purposes of cashless catering.

London Borough of Hackney

05 July 2024, Reprimands, Local government

The Information Commissioner’s Office has issued the London Borough of Hackey with a reprimand following a cyber-attack in 2020 that led to hackers gaining access to and encrypting 440,000 files, affecting at least 280,000 residents and other individuals including staff.

Birmingham Children's Trust Community Interest Company

14 May 2024, Reprimands

Reprimand issued to Birmingham Children’s Trust Community Interest company in respect of Article 5(1)(f) and 32(1)(b) and 2. A child protection plan containing inappropriate personal data, in the form of criminal allegations against a child, was sent to the family the plan was produced for. Although the care plan itself was authorised for the family to view, the criminal allegations were not relevant to the plan, or authorised for the family’s view. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.

The Central Young Men’s Christian Association

30 April 2024, Reprimands, Charitable and voluntary

The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealing the email addresses to all recipients. 166 individuals could be identified or potentially identified from their email address. As a result, it could be inferred that these individuals were likely to be living with HIV. The Central YMCA have been fined £7,500 and issued a reprimand.

The Central Young Men’s Christian Association

30 April 2024, Monetary penalties, Charitable and voluntary

The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealing the email addresses to all recipients. 166 individuals could be identified or potentially identified from their email address. As a result, it could be inferred that these individuals were likely to be living with HIV. The Central YMCA have been fined £7,500 and issued a reprimand.

Outsource Strategies Ltd

24 April 2024, Enforcement notices, Marketing

Outsource Strategies Ltd made 1,346,503 unwanted marketing calls between 11 February 2021 and 22 March 2022 to numbers registered with the TPS. The ICO received 74 complaints from people variously saying they received repeated calls despite requests to stop and that the callers were aggressive.

Outsource Strategies Ltd

23 April 2024, Monetary penalties

Outsource Strategies Ltd made 1,346,503 unwanted marketing calls between 11 February 2021 and 22 March 2022 to numbers registered with the TPS. The ICO received 74 complaints from people variously saying they received repeated calls despite requests to stop and that the callers were aggressive.

Dr Telemarketing

23 April 2024, Monetary penalties

Between 11 February 2021 to 24 January 2022, there were 80,240 connected calls unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified DRT that they were willing to receive such calls, and two complaints being submitted as a result. Calls were about the Irish Lottery. DRT stopped engaging with the Commissioner part way through the investigation and failed to provide a satisfactory explanation for the Lotto Express calls involved in the contravention.

Dr Telemarketing

23 April 2024, Enforcement notices

Between 11 February 2021 to 24 January 2022, there were 80,240 connected calls unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified DRT that they were willing to receive such calls, and two complaints being submitted as a result. Calls were about the Irish Lottery. DRT stopped engaging with the Commissioner part way through the investigation and failed to provide a satisfactory explanation for the Lotto Express calls involved in the contravention.