The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Enforcement action

3 in total

The Tavistock & Portman NHS Foundation Trust

30 June 2022, Monetary penalties, Health

Between the period 25 May 2018 to 6 September 2019, the Trust used Outlook to send bulk emails to 1,781 Gender Identity Clinic service users. The Trust failed to comply with Chapter II GDPR, specifically Articles 5(1)(f), and 32(1) & (2).

The Ministry of Justice

18 January 2022, Enforcement notices, Central government

The Ministry of Justice has contravened Article 15 of the EU and UK and Section 45 DPA18 in that it has failed to provide, without undue delay, 7,753 data subjects with a copy of their data in accordance with its legal obligations.

Cabinet Office

02 December 2021, Monetary penalties, Central government

The Information Commissioner’s Office (ICO) has fined the Cabinet Office £500,000 for disclosing postal addresses of the 2020 New Year Honours recipients online.