Enforcement action

Home Office

21 March 2024, Enforcement notices, Central government

An enforcement notice and a warning have been issued to the Home Office for failing to assess the privacy risks posed by the electronic monitoring of people arriving in the UK by unauthorised means. The ICO has been in discussion with the Home Office regarding its pilot to place ankle tags on, and track the GPS location of, up to 600 migrants who arrived in the UK and were on immigration bail. Although the pilot ended in December 2023, the Home Office has retained the GPS location data collected by the tags and will continue to be able to access and use that data including sharing it with other third-party organisations. The enforcement notice orders the Home Office to update its internal policies, access guidance and privacy information in relation to the data retained from the pilot. The warning issued also states that any future processing on the same basis will be in breach of data protection law and will attract enforcement action.

Ministry of Defence

26 February 2024, Monetary penalties, Central government

The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of GDPR Article 5(1)(f). The MOD were fined £350,000.

Executive Office

21 July 2023, Reprimands, Central government

On 22 May 2020, the Interim Advocate’s Office sent a newsletter by email to 251 subscribers on its mailing list using the ‘To’ field. The email addresses of the recipients were visible to all who received the email.

Ministry of Justice

27 April 2023, Reprimands, Central government

14 bags of confidential waste were found in an unsecured holding area in the prison, which both prisoners and staff had access to.

Department for Education

02 November 2022, Reprimands, Central government

The DfE permitted third party access to the LRS database outside of the DfE and subsequent processing took place of some of that personal data (including children) for the purposes of age verification, without appropriate control or oversight. The investigation has found that therefore the personal data on the LRS database was processed in an insecure manner and for purposes that were not initially intended. Furthermore, the DfE failed to be transparent about that processing.

Secretary of State for the Home Department

07 October 2022, Reprimands, Central government

On 5 September 2021 an envelope containing four documents classified 'Official Sensitive' (the Documents) was found at a venue in London, by venue staff. On 6 September 2021, the venue staff handed the documents in to the police and the police subsequently handed them to the Home Office on the same day.

Secretary of State for the Home Department (Home Office) (1)

21 September 2022, Reprimands, Central government

A reprimand has been issued to the Home Office following investigations that showed between March 2021 and November 2021, they had a significant back log of SARs, amounting to just under 21,000 not being responded to during the statutory timeframe. Complaints to the ICO showed requesters suffered significant distress as a result. As of July 2022, there are just over 3,000 unanswered SARs outside of the legal time limit.

Secretary of State for the Home Department (Home Office)

16 August 2022, Reprimands, Central government

A Home Office employee contacted members of the public as part of the creation of an education programme for staff into the historical background and circumstances of individuals arriving into the UK which had led to the matter that became widely and collectively known as the “Windrush scandal” occurring. It is my understanding that interviews were conducted with individuals who had previously been affected by the ”scandal”; that the interviews were recorded on the employee’s personal mobile phone; and subsequently uploaded to her personal YouTube account, from where they were shared with other Home Office employees.

Department of Health and Social Care

11 July 2022, Reprimands, Central government

The ICO has issued the DHSC with a reprimand in relation to data protection compliance matters under the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UKGDPR) and the UK Data Protection Act 2018 (DPA).