Enforcement action

Mayor’s Office for Policing and Crime (MOPAC)

13 March 2024, Reprimands, Local government

Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 November 2022, a member of GLA intended to give four members of MOPAC permission to the webforms. However, instead of granting permission to the four members of MOPAC, they made two web forms public. On 23 February 2023 MOPAC were made aware by a member of the public that it was possible for users to click a button that would enable users to access information on every query that had been submitted via the form. 394 people were later notified of the breach due to the nature of the personal data that was made publicly accessible on the forms.

Charnwood Borough Council

29 November 2023, Reprimands, Local government

Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abuse against the data subject. This caused significant distress to the data subject and has the potential to result in actual harm. In addition, the investigation highlighted that the process to make address changes was not properly communicated to the data subject, and that there was an absence of a written and well communicated process for dealing with correspondence in these sensitive circumstances for staff to use. In addition, the Council had not ensured that all members of staff involved in this incident had received data protection training in the twelve months prior to the incident.

Gloucester City Council

01 September 2023, Reprimands, Local government

The Information Commissioner (the Commissioner) issues a reprimand to Gloucester City Council in respect of infringements of Article 32(1)b, Article 32(1)c and Article 32(1)d of the UK GDPR. Gloucester City Council failed to implement appropriate technical and organisational measures to properly secure their systems.

London Borough of Lewisham

16 August 2023, Reprimands, Local government

During the period of 3 January 2022 to 3 January 2023, 35% of subject access requests (SARs) that London Borough of Lewisham received were not responded to within the statutory deadlines of one and three months. A reprimand has therefore been issued to London Borough of Lewisham in relation to infringements of Article 12(3) and Article 15(1) of the UK General Data Protection Regulation (UK GDPR).

Shropshire Council

09 May 2023, Enforcement notices, Local government

The Information Commissioner’s Office (ICO) has issued an enforcement notice to Shropshire Council for its poor handling of requests made under the Freedom of Information Act (FOIA) 2000.

Norfolk County Council

05 May 2023, Reprimands, Local government

Norfolk County Council has only responded to 260 out of 511 SARs it received within the statutory timescales from 6 April 2021 to 6 April 2022.

Plymouth City Council

28 April 2023, Reprimands, Local government

A reprimand has been issued to Plymouth City Council in relation to the infringements of Article 12 (3) and Article 15 of the UK GDPR. This case forms part of the ICO’s wider work into Subject Access Request compliance.

London Borough of Lewisham

21 March 2023, Enforcement notices, Local government

The London Borough of Lewisham has been served with an Enforcement Notice as a result of the evidence seen by the Commissioner about its performance in relation to its statutory duties under the Freedom of information Act (FOIA).

London Borough of Lambeth

23 September 2022, Reprimands, Local government

London Borough of Lambeth has only responded to 74% of the SARs it has received within the statutory timescales from 1 August 2020 to 11 August 2021. This equates to 268 SARs. The council continues to have a backlog of SAR cases and, based on the updated figures, does not appear to be improving.

Wakefield Council

22 September 2022, Reprimands, Local government

A reprimand was issued after the Council sent papers prepared as a Court bundle, in relation to Child Protection Legal Proceedings, to the parents of the child in question. The Court documents contained a Child Protection Medical Report which included the home address of the mother and her two children.

London Borough of Hackney

21 September 2022, Reprimands, Local government

For the period of April 2020 to February 2021, London Borough of Hackney did not respond to over 60% of the SARs submitted to them in the statutory timeframe. The oldest SAR was over 23 months.

London Borough of Croydon

26 July 2022, Reprimands, Local government

From April 2020 to April 2021, the London Borough of Croydon Council responded to less than half of their SARs within the statutory timescales. This meant that 115 residents did not receive a response in accordance with the UKGDPR. Additionally, since June 2021, the ICO has issued 27 decisions notices under FOIA related to the Council’s failure to respond to information requests. They were issued with a reprimand.

North Yorkshire County Council

07 April 2022, Reprimands, Local government

An NYCC employee failed to accurately complete the print to post process and as a result two envelopes containing multiple letters were sent to two different recipients.