85% of last year's delegates said they learned something new at our conference.
Register now to hear the latest on topics like cyber security, artificial intelligence and legislative reform.
Filters
3 September 2025, Prosecutions, Health
The director of a care home in Bridlington, Yorkshire, has been fined for refusing to respond to a request for a resident’s personal information – known as a subject access request (SAR).
28 August 2025, Monetary penalties, Utilities
Green Spark Energy Ltd (GSE) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends in relation to the energy and home improvements sector. In March 2024, the ICO carried out a search warrant to obtain evidence in relation to GSE and its compliance with PECR. Following an extensive investigation, it was revealed that between May 2023 to May 2024, GSE instigated the transmission of, 9,587,050 communications comprising recorded matter for direct marketing purposes by means of an automated calling system, contrary to regulation 19 of PECR. This resulted in 497 complaints being made to the TPS and the ICO reporting tools. The recordings used by GSE contained misleading statements to pressure homeowners, including suggesting their existing loft insulation was likely to cause serious health problems. Several of the complainants thought the calls were a ‘scam’ and said the company failed to identify themselves.
28 August 2025, Enforcement notices, Utilities
Home Improvement Marketing Ltd (HIML) was investigated as part of a wider operation set up by the Commissioner to assess and analyse complaint trends in relation to the energy and home improvements sector. In March 2024, the ICO carried out a search warrant to obtain evidence in relation to HIML and its compliance with PECR. Following an extensive investigation, it was revealed that between 31 May 2023 and 31 August 2023, HIML instigated the transmission of 2,449,380 automated marketing calls to subscribers without their prior consent contrary to regulation 19 of PECR. This resulted in 274 complaints being made to the TPS and the ICO reporting tools. Several complainants stated they were receiving multiple recorded calls a day. The software responded based on a recipient’s answers and there was no option to opt-out of further calls.
27 August 2025, Enforcement notices, Local government
The Information Commissioner’s Office (ICO) has issued an enforcement notice to Bristol City Council (BCC) for failing to comply with its legal obligations to respond to people who asked for the personal information the council held on them – known as a subject access request (SAR).
24 June 2025, Monetary penalties, Charitable and voluntary
The Information Commissioner’s Office (ICO) has fined Scottish charity Birthlink £18,000 after it destroyed approximately 4,800 personal records, up to ten percent of which may be irreplaceable.
6 June 2025, Reprimands, Criminal justice
A reprimand has been issued to South Yorkshire Police for failing to ensure it had appropriate technical security and organisation measures in place which led to the accidental deletion of 96,174 pieces of original Body Worn Video footage. The redaction in the reprimand was actioned by the ICO
5 June 2025, Monetary penalties, General business
16 May 2025, Reprimands, Local government
We issued a reprimand to the London Borough of Hammersmith and Fulham after hidden data within a spreadsheet was inadvertently disclosed in response to a Freedom of Information Act request.
15 May 2025, Reprimands, Criminal justice
Due to historic outstanding requests Chief Constable Greater Manchester Police had continually failed to meet its data protection obligations when responding to subject access requests (SARs) infringing Article 12(3) of UK GDPR, Article 15 of UK GDPR and Section 45, Part 3 of DPA 2018 and Section 54, Part 3 of DPA 2018.
24 April 2025, Enforcement notices, General business
Between 9 January 2023 to 9 October 2023, there were 194,110 unsolicited direct marketing calls made to subscribers who were registered with the TPS and who had not notified Darian Bishop that they were willing to receive such calls. This resulted in 21 complaints which were submitted to the Commissioner and the TPS.
24 April 2025, Monetary penalties, General business
14 April 2025, Monetary penalties, General business
The Information Commissioner has fined law firm DPP Law Ltd £60,000 for its infringements of Articles 5(1)(f), 32(1), 32(2) and 33(1) of the UK GDPR between 25 May 2018 and 17 July 2022.
27 March 2025, Monetary penalties, General business
It was found that between January and September 2023, AFK made 95,277 spam calls resulting in several complaints being made to the ICO and TPS. AFK did not provide evidence that anyone whose number had been called had consented to receiving calls from the company. The ICO has issued a £90,000 fine.
27 March 2025, Enforcement notices
26 March 2025, Monetary penalties, General business
The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (Advanced) £3.07m for security failings that put the personal information of 79,404 people at risk.
14 March 2025, Reprimands, Criminal justice
We issued a reprimand to Greater Manchester Police for failing to ensure that appropriate technical or organisational measures were in place to protect the accidental loss of CCTV data and the failure to provide a data subject with their personal data, both without undue delay and by the end of the applicable period of one month.
19 February 2025, Enforcement notices, Finance insurance and credit
Between 4 July 2023 to 24 August 2023 Smart Home Ensured Limited made 14,508 unsolicited calls for direct marketing purposes in breach of Regulation 21 of PECR. The company has been issued with an Enforcement Notice.
4 February 2025, Reprimands, Local government
A reprimand was issued to Glasgow City Council as during the period between 01 April 2023 to 01 March 2024, they responded to 45% of incoming subject access requests within the statutory timeframe, thereby infringing Articles 12(3), 15(1) and 15(3) of the UK GDPR.
3 February 2025, Reprimands, Local government
A reprimand was issued to City of Edinburgh Council as during the period between 01 January 2023 to 31 December 2023, it had failed to respond to 40% of Subject Access Requests within the statutory timeframe of one calendar month, thereby infringing Articles 12(3), 15(1) and 15(3) of the UK GDPR.
13 December 2024, Reprimands, Health
A reprimand was issued to United Lincolnshire Teaching Hospitals NHS Trust as during the period between 01 March 2021 to 31 March 2022, it had failed to respond to 32% of Subject Access Requests within the statutory timeframe of one calendar month, thereby infringing Articles 12(3), 15(1) and 15(3) of the UK GDPR.
12 December 2024, Enforcement notices, General business
It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to the ICO and TPS. MBL did not provide evidence that anyone whose number had been called had consented to receiving calls from the company. The ICO has issued a £120,000 fine.
12 December 2024, Monetary penalties, General business
12 December 2024, Enforcement notices
Breathe Services Ltd (BSL), a debt advice company based in Bolton, first came to the attention of the ICO as part of a wider investigation into complaints received about unsolicited phone calls to potentially vulnerable individuals. In a failed attempt to hide their real identity, BSL was found to have spoofed its outbound phone number by presenting over 1,000 different telephone numbers on calls. In March 2023 the ICO carried out a search at BSL’s office in Bolton, seizing evidence including documents and electronic devices. Our extensive investigation revealed that between March - July 2022 and October - December 2022, BSL bombarded people with 4,376,037 unsolicited direct marketing calls to numbers that had been registered to the Telephone Preference Service (TPS). This resulted in 58 complaints to the TPS and a further 193 complaints to the ICO.