1. Action we've taken

Enforcement action

36 in total

The Royal Borough of Kensington and Chelsea

16 April 2018, Monetary penalties, Local government

The Royal Borough of Kensington and Chelsea has been fined £120,000 by the Information Commissioner’s Office (ICO) after it unlawfully identified 943 people who owned vacant properties in the…

Pennine Care NHS Foundation Trust

02 February 2018, Undertakings, Health

A follow up has been completed to provide an assurance that Pennine Care NHS Foundation Trust has appropriately addressed the actions agreed in its undertaking signed 1 February 2017.

Secretary of State for Justice

21 December 2017, Enforcement notices, Central government

Secretary of State for Justice enforcement notice.

Marian Waddell

13 November 2017, Prosecutions, Health

Marian Waddell, a former nursing auxiliary was fined for accessing a patient and her neighbour’s medical records without a valid legal reason.

Clair Francis

09 November 2017, Prosecutions, Health

Clair Francis, who worked as a Coding Officer for Dudley Group NHS Trust, pleaded guilty to one offence of obtaining personal data and one offence of disclosing personal data. She accessed her neighbour and former friend’s medical records and disclosed information about a baby.

Nicola Wren

16 October 2017, Prosecutions, Health

A former administrator employed by Kent and Medway NHS and Social Care Partnership Trust has been prosecuted by the ICO at Medway Magistrates’ Court.

Nilesh Morar

21 September 2017, Prosecutions, Local government

Nilesh Morar has been prosecuted at Nuneaton Magistrates’ Court for the offence of unlawfully obtaining personal data.

Linda Reeves

04 September 2017, Prosecutions, Health

A former data co-ordinator employed by The University Hospitals of North Midlands NHS Trust has been prosecuted at North Staffordshire Magistrates’ Court. Linda Reeves accessed the sensitive medical records of colleagues as well as people she knew that lived in her locality, without the consent of the data controller. Ms Reeves pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £700, ordered to pay costs of £364.08 and a £70 Victim Surcharge.

Nottinghamshire County Council

31 August 2017, Monetary penalties, Local government

A council has been fined £70,000 by the Information Commissioner’s Office for leaving vulnerable people’s personal information exposed online for five years.  

London Borough of Islington

17 August 2017, Monetary penalties, Local government

Islington Council failed to keep up to 89,000 people’s information secure on its parking ticket system website. That was the conclusion of an Information Commissioner’s Office investigation which has resulted in a £70,000 fine for the London borough.

Brioney Woolfe

11 August 2017, Prosecutions, Health

A former employee of Colchester Hospital University NHS Foundation Trust, Brioney Woolfe, has been prosecuted at The Colchester Magistrates’ Court. The former Midwifery Assistant pleaded guilty to two offences under section 55 of the Data Protection Act for accessing the sensitive health records of friends and people she knew and disclosing some of the personal information obtained. Ms Woolfe was fined £400, for the offence of obtaining personal data and £650 for disclosing it, order to pay prosecution costs of £600 and a victim surcharge £65.

Cheshire West and Chester Council

10 August 2017, Undertakings, Local government

An Undertaking to comply with the seventh data protection principle has been signed by Cheshire West and Chester Council.

Royal Free London NHS Foundation Trust

03 July 2017, Undertakings, Health

The ICO has ruled the Royal Free London NHS Foundation Trust failed to comply with the Data Protection Act when it provided patient details to Google DeepMind.

Medway Council

13 June 2017, Enforcement notices, Local government

Medway Council has been issued with an enforcement notice by the Information Commissioner's Office.

Gloucester City Council

12 June 2017, Monetary penalties, Local government

The Information Commissioner’s Office has fined Gloucester City Council £100,000 after a cyber attacker accessed council employees’ sensitive personal information.

Basildon Borough Council

31 May 2017, Monetary penalties, Local government

A council has been fined £150,000 by the Information Commissioner’s Office for publishing sensitive personal information about a family.

Sally Anne Day

16 May 2017, Prosecutions, Health

A former administration employee of Crickhowell Group Practice, part of the Powys Health Trust Board, has been prosecuted at Newport Crown Court for accessing the sensitive medical records of two patients without the consent of the data controller. Ms Sally Anne Day pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £400, ordered to pay costs of £350 and a victim surcharge of £40.

London Borough of Ealing

03 May 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that the London Borough of Ealing has appropriately addressed the actions agreed in its undertaking signed October 2016.

Northern HSC Trust

11 April 2017, Undertakings, Health

A follow up has been completed to provide an assurance that Northern HSC Trust has or is taking action to meet the requirements of the undertaking signed July 2016 .

Wolverhampton City Council

29 March 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that Wolverhampton City Council has appropriately addressed the actions agreed in its undertaking signed June 2016.

Norfolk County Council

20 March 2017, Monetary penalties, Local government

A county council which left files that included sensitive information about children in a cabinet sent to a second hand shop has been fined £60,000 by the Information Commissioner’s Office.

HCA International Ltd

28 February 2017, Monetary penalties, Health

The Information Commissioner’s Office has fined a private health company, HCA International Ltd, for failing to keep fertility patients’ personal information secure. 

Pennine Care NHS Trust

21 February 2017, Undertakings, Health

An Undertaking to comply with the seventh data protection principle has been signed by Pennine Care NHS Trust.

Cornwall Council

17 February 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that Cornwall Council has appropriately addressed the actions agreed in its undertaking signed September 2016.

NHS Digital (formerly known as HSCIC)

10 February 2017, Undertakings, Health

A follow up has been completed to provide an assurance that NHS Digital (formerly known as HSCIC) has appropriately addressed the actions agreed in its undertaking signed April 2016.