Enforcement action

Southend-on-Sea City Council

17 October 2024, Reprimands, Local government

We issued a reprimand to Southend-on-Sea City Council in Essex after hidden data on a spreadsheet released as part of a freedom of information request revealed the sensitive personal details of staff

Reprimand issued to Levales Solicitors LLP (‘Levales’) in respect of Articles 32(1)(b) and 32(1)(d). A threat actor accessed Levales’ cloud-based server using legitimate credentials and subsequently published data on the dark web. The incident affected 8,234 UK individuals, of which 863 individuals were deemed at high risk because of the nature of the data involved. The investigation found Levales were not ensuring the ongoing confidentiality of its processing systems and did not implement appropriate organisational measures.

Bonne Terre Limited t/a Sky Betting and Gaming

17 September 2024, Reprimands, Online technology and telecoms

We issued a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing people’s data through advertising cookies without their consent.

The Labour Party

28 August 2024, Reprimands, Political

The Labour Party were issued with a reprimand for failing to respond to people’s request for their own personal data, also know as a subject access request, and for failing to respond to peoples request for erasure.

The Electoral Commission

30 July 2024, Reprimands, Central government

Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately 40,000,000 individuals, and the initial access was gained via several unpatched software vulnerabilities. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.

Chelmer Valley High School

22 July 2024, Reprimands, Education and childcare

Chelmer Valley High School have been issued a reprimand in respect of Article 35(1). The school failed to complete a Data Protection Impact Assessment (DPIA) prior to introducing facial recognition technology for the purposes of cashless catering.

London Borough of Hackney

05 July 2024, Reprimands, Local government

The Information Commissioner’s Office has issued the London Borough of Hackey with a reprimand following a cyber-attack in 2020 that led to hackers gaining access to and encrypting 440,000 files, affecting at least 280,000 residents and other individuals including staff.

Birmingham Children's Trust Community Interest Company

14 May 2024, Reprimands

Reprimand issued to Birmingham Children’s Trust Community Interest company in respect of Article 5(1)(f) and 32(1)(b) and 2. A child protection plan containing inappropriate personal data, in the form of criminal allegations against a child, was sent to the family the plan was produced for. Although the care plan itself was authorised for the family to view, the criminal allegations were not relevant to the plan, or authorised for the family’s view. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.

The Central Young Men’s Christian Association

30 April 2024, Reprimands, Charitable and voluntary

The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealing the email addresses to all recipients. 166 individuals could be identified or potentially identified from their email address. As a result, it could be inferred that these individuals were likely to be living with HIV. The Central YMCA have been fined £7,500 and issued a reprimand.

Clyde Valley Housing Association

18 April 2024, Reprimands, Land or property services

Clyde Valley Housing Association have received the following reprimand because of an infringement that occurred in July 2022 when they released a new customer portal. This portal included personal data of data subjects and residents found they were able to view personal information such as names and addresses about other residents. A resident reported this to Clyde Valley Housing Association, however this concern was not escalated appropriately which led to data remaining viewable on the portal for a further 5 days until further residents reported the issue and Clyde Valley Housing Association suspended the portal.

University Hospital of Southampton NHS Foundation Trust

05 April 2024, Reprimands, Health

A reprimand is being issued to University Hospital of Southampton NHS Foundation Trust as they have only responded to 59% of incoming SARs within the statutory timeframe during the period of 01 August 2022 to 01 July 2023.

Dover Harbour Board

15 March 2024, Reprimands, Criminal justice

A reprimand is being issued to Dover Harbour Board in respect of the creation and use of a social media distribution group, initially created in WhatsApp but later migrated to Telegram. From the evidence provided to the ICO, the distribution groups were used by multiple UK police forces and international law enforcement agencies for the purpose of combatting vehicle crime. The distribution groups were created by an officer from the Port of Dover Police using his personal mobile phone without organisational oversight or compliance with data protection legislation.

Chief Constable of Kent Police

15 March 2024, Reprimands, Criminal justice

A reprimand is being issued to Kent Police in respect of an incident in February 2021 when a Kent Police officer took a photograph of an individual’s identity document using her personal mobile phone and uploaded the image onto Telegram, a social media application. From the evidence provided to the ICO, the Telegram distribution group onto which the image was uploaded was being used by multiple UK police forces and international law enforcement agencies for the purpose of combatting vehicle crime. The Kent Police officer did not inform the individual that further processing of his personal data would take place; how it would be processed; or the purpose for doing so.

Mayor’s Office for Policing and Crime (MOPAC)

13 March 2024, Reprimands, Local government

Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 November 2022, a member of GLA intended to give four members of MOPAC permission to the webforms. However, instead of granting permission to the four members of MOPAC, they made two web forms public. On 23 February 2023 MOPAC were made aware by a member of the public that it was possible for users to click a button that would enable users to access information on every query that had been submitted via the form. 394 people were later notified of the breach due to the nature of the personal data that was made publicly accessible on the forms.

Chief Constable West Midlands Police

01 March 2024, Reprimands, Criminal justice

A reprimand has been issued to West Midlands Police after the force repeatedly incorrectly linked and merged the records of two individuals with similar personal data. West Midlands Police failed to ensure the accuracy of the personal data of these two individuals, resulting in multiple incidents where officers attended a wrong address, including on one occasion when there were serious safeguarding concerns relating to one of the individuals.

Chief Constable Devon and Cornwall Police

02 February 2024, Reprimands, Criminal justice

Chief Constable Devon and Cornwall Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years. In this case, Devon and Cornwall Police have had a subject access request backlog since 2018 which has resulted in a large number of subject access requests not being responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.

Chief Constable Dorset Police

02 February 2024, Reprimands, Criminal justice

Chief Constable Dorset Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years. In this case, Dorset Police have had a subject access request backlog since 2018 which has resulted in a large number of subject access requests not being responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.

South Tees Hospitals NHS Trust

20 December 2023, Reprimands, Health

The reprimand was issued as the South Tees Hospitals NHS Trust (the Trust) was found to have not ensured that its staff were fully trained and prepared to deal with correspondence that was particularly sensitive, and which had been referred to the Trust via legitimate but unusual channels. Staff were not provided with appropriate guidance to ensure that they could deal with sensitive correspondence in every situation. The effect of the infringement was that significant distress was caused to the family of a child patient at a time that was already particularly traumatic for the family.

Finham Park Multi Academy Trust

07 December 2023, Reprimands, Education and childcare

Finham Park Multi Academy Trust have been issued a Reprimand in respect of Articles 5 (1) (f) and 32 (1) (b). An unauthorised third party utilised compromised credentials to access and encrypt Finham Park’s systems. 1843 UK Data Subjects were affected by the incident, and the ICO’s investigation found Finham Park did not have adequate account lockout or password policies in place.

Bank of Ireland

30 November 2023, Reprimands, Finance insurance and credit

BOI failed to ensure the accuracy of customers’ default loan status which led to inaccurate personal data being held on their account which was subsequently incorrectly recorded on customers’ credit profile.

Charnwood Borough Council

29 November 2023, Reprimands, Local government

Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abuse against the data subject. This caused significant distress to the data subject and has the potential to result in actual harm. In addition, the investigation highlighted that the process to make address changes was not properly communicated to the data subject, and that there was an absence of a written and well communicated process for dealing with correspondence in these sensitive circumstances for staff to use. In addition, the Council had not ensured that all members of staff involved in this incident had received data protection training in the twelve months prior to the incident.

NHS Fife

23 November 2023, Reprimands, Health

The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Fife, after an unauthorised individual was able to enter a ward and access the personal information of 14 patients.

GRS (Roadstone) Limited

14 November 2023, Reprimands, General business

The Information Commissioner (the Commissioner) issues a reprimand to GRS (Roadstone) Limited in respect of infringements of Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised Threat Actor being able to exfiltrate the individual personal data of current and former employees.

University Hospital of Derby and Burton NHS Trust (UHDB)

30 October 2023, Reprimands, Health

UHDB failed to have adequate processes in place, especially when processing special category data, which resulted in referrals for out-patients’ appointments not being processed in a timely manner. In some cases, this led to delays of up to two years before medical treatment was arranged.

Police Service of Northern Ireland (PSNI)

26 October 2023, Reprimands, Criminal justice

PSNI failed to have appropriate measures in place to prevent unlawful sharing of personal data including criminal data with the United States Department of Homeland Security (DHS).