Enforcement action

University Hospital of Southampton NHS Foundation Trust

05 April 2024, Reprimands, Health

A reprimand is being issued to University Hospital of Southampton NHS Foundation Trust as they have only responded to 59% of incoming SARs within the statutory timeframe during the period of 01 August 2022 to 01 July 2023.

Home Office

21 March 2024, Enforcement notices, Central government

An enforcement notice and a warning have been issued to the Home Office for failing to assess the privacy risks posed by the electronic monitoring of people arriving in the UK by unauthorised means. The ICO has been in discussion with the Home Office regarding its pilot to place ankle tags on, and track the GPS location of, up to 600 migrants who arrived in the UK and were on immigration bail. Although the pilot ended in December 2023, the Home Office has retained the GPS location data collected by the tags and will continue to be able to access and use that data including sharing it with other third-party organisations. The enforcement notice orders the Home Office to update its internal policies, access guidance and privacy information in relation to the data retained from the pilot. The warning issued also states that any future processing on the same basis will be in breach of data protection law and will attract enforcement action.

Mayor’s Office for Policing and Crime (MOPAC)

13 March 2024, Reprimands, Local government

Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 November 2022, a member of GLA intended to give four members of MOPAC permission to the webforms. However, instead of granting permission to the four members of MOPAC, they made two web forms public. On 23 February 2023 MOPAC were made aware by a member of the public that it was possible for users to click a button that would enable users to access information on every query that had been submitted via the form. 394 people were later notified of the breach due to the nature of the personal data that was made publicly accessible on the forms.

Ministry of Defence

26 February 2024, Monetary penalties, Central government

The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of GDPR Article 5(1)(f). The MOD were fined £350,000.

South Tees Hospitals NHS Trust

20 December 2023, Reprimands, Health

The reprimand was issued as the South Tees Hospitals NHS Trust (the Trust) was found to have not ensured that its staff were fully trained and prepared to deal with correspondence that was particularly sensitive, and which had been referred to the Trust via legitimate but unusual channels. Staff were not provided with appropriate guidance to ensure that they could deal with sensitive correspondence in every situation. The effect of the infringement was that significant distress was caused to the family of a child patient at a time that was already particularly traumatic for the family.

Charnwood Borough Council

29 November 2023, Reprimands, Local government

Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abuse against the data subject. This caused significant distress to the data subject and has the potential to result in actual harm. In addition, the investigation highlighted that the process to make address changes was not properly communicated to the data subject, and that there was an absence of a written and well communicated process for dealing with correspondence in these sensitive circumstances for staff to use. In addition, the Council had not ensured that all members of staff involved in this incident had received data protection training in the twelve months prior to the incident.

NHS Fife

23 November 2023, Reprimands, Health

The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Fife, after an unauthorised individual was able to enter a ward and access the personal information of 14 patients.

University Hospital of Derby and Burton NHS Trust (UHDB)

30 October 2023, Reprimands, Health

UHDB failed to have adequate processes in place, especially when processing special category data, which resulted in referrals for out-patients’ appointments not being processed in a timely manner. In some cases, this led to delays of up to two years before medical treatment was arranged.

Gloucester City Council

01 September 2023, Reprimands, Local government

The Information Commissioner (the Commissioner) issues a reprimand to Gloucester City Council in respect of infringements of Article 32(1)b, Article 32(1)c and Article 32(1)d of the UK GDPR. Gloucester City Council failed to implement appropriate technical and organisational measures to properly secure their systems.

London Borough of Lewisham

16 August 2023, Reprimands, Local government

During the period of 3 January 2022 to 3 January 2023, 35% of subject access requests (SARs) that London Borough of Lewisham received were not responded to within the statutory deadlines of one and three months. A reprimand has therefore been issued to London Borough of Lewisham in relation to infringements of Article 12(3) and Article 15(1) of the UK General Data Protection Regulation (UK GDPR).

NHS Lanarkshire

31 July 2023, Reprimands, Health

The Information Commissioner (the Commissioner) issues a reprimand to NHS Lanarkshire in accordance with Article 58 (2)(b) of the UK General Data Protection Regulation (UK GDPR) for the sharing of personal data of patients via unauthorised means and secondly, a disclosure of personal data.

Executive Office

21 July 2023, Reprimands, Central government

On 22 May 2020, the Interim Advocate’s Office sent a newsletter by email to 251 subscribers on its mailing list using the ‘To’ field. The email addresses of the recipients were visible to all who received the email.

The Patient and Client Council

19 July 2023, Reprimands, Health

A reprimand has been issued to The Patient and Client Council in relation to infringements of Article 5 (1)(f) and Article 32 (1) of the UK GDPR. The infringements were identified following an investigation into the disclosure of special category due to an email sent to 15 individuals using carbon copy (CC) rather than blind carbon copy (BCC).

Shropshire Council

09 May 2023, Enforcement notices, Local government

The Information Commissioner’s Office (ICO) has issued an enforcement notice to Shropshire Council for its poor handling of requests made under the Freedom of Information Act (FOIA) 2000.

Norfolk County Council

05 May 2023, Reprimands, Local government

Norfolk County Council has only responded to 260 out of 511 SARs it received within the statutory timescales from 6 April 2021 to 6 April 2022.

Plymouth City Council

28 April 2023, Reprimands, Local government

A reprimand has been issued to Plymouth City Council in relation to the infringements of Article 12 (3) and Article 15 of the UK GDPR. This case forms part of the ICO’s wider work into Subject Access Request compliance.

Ministry of Justice

27 April 2023, Reprimands, Central government

14 bags of confidential waste were found in an unsecured holding area in the prison, which both prisoners and staff had access to.

University Hospitals Dorset NHS Foundation Trust

25 April 2023, Reprimands, Health

The Information Commissioner (the Commissioner) issues a reprimand to University Hospitals Dorset NHS Foundation Trust (the Trust) in accordance with Article 58(2)(b) of the UK General Data Protection Regulation in respect of certain infringements of the UK GDPR.

London Borough of Lewisham

21 March 2023, Enforcement notices, Local government

The London Borough of Lewisham has been served with an Enforcement Notice as a result of the evidence seen by the Commissioner about its performance in relation to its statutory duties under the Freedom of information Act (FOIA).

NHS Highland

09 March 2023, Reprimands, Health

A formal reprimand has been issued to NHS Highland, which emailed 37 people likely to be accessing HIV services, inadvertently using CC (carbon copy) instead of BCC (blind carbon copy). The error meant recipients of the email could see the personal email addresses of other people receiving the email, with one person confirming they recognised four other individuals, one of whom was a previous sexual partner.

University Hospitals Bristol and Weston NHS Foundation Trust

07 March 2023, Reprimands, Health

Patient records were saved on to an Electronic Document Viewing System. The Trust decided to terminate the use of this system and the records on it were downloaded prior to allowing the system licence to expire. However this download was not fully successful but this was not investigated prior to the licence expiry and therefore a number of records became inaccessible and some permanently lost.

NHS Blood and Transplant

03 March 2023, Reprimands, Health

The Commissioner has decided to issue NHSBT with a reprimand in accordance with Article 58 of the GDPR, after they inadvertently released untested development code into a live system for matching transplant list patients with donated organs in August 2019.

Royal Free London NHS Foundation Trust

10 November 2022, Reprimands, Health

Hysteroscopy scans were saved on to a series of three USB sticks over a period of nine years from May 2013 until the remaining two encrypted USB sticks became inaccessible on 5 April 2018. It is unknown whether this inaccessibility was as a result of a technical failure of the USBs or human error from inputting the wrong password.

Department for Education

02 November 2022, Reprimands, Central government

The DfE permitted third party access to the LRS database outside of the DfE and subsequent processing took place of some of that personal data (including children) for the purposes of age verification, without appropriate control or oversight. The investigation has found that therefore the personal data on the LRS database was processed in an insecure manner and for purposes that were not initially intended. Furthermore, the DfE failed to be transparent about that processing.

Secretary of State for the Home Department

07 October 2022, Reprimands, Central government

On 5 September 2021 an envelope containing four documents classified 'Official Sensitive' (the Documents) was found at a venue in London, by venue staff. On 6 September 2021, the venue staff handed the documents in to the police and the police subsequently handed them to the Home Office on the same day.

London Borough of Lambeth

23 September 2022, Reprimands, Local government

London Borough of Lambeth has only responded to 74% of the SARs it has received within the statutory timescales from 1 August 2020 to 11 August 2021. This equates to 268 SARs. The council continues to have a backlog of SAR cases and, based on the updated figures, does not appear to be improving.

Wakefield Council

22 September 2022, Reprimands, Local government

A reprimand was issued after the Council sent papers prepared as a Court bundle, in relation to Child Protection Legal Proceedings, to the parents of the child in question. The Court documents contained a Child Protection Medical Report which included the home address of the mother and her two children.

London Borough of Hackney

21 September 2022, Reprimands, Local government

For the period of April 2020 to February 2021, London Borough of Hackney did not respond to over 60% of the SARs submitted to them in the statutory timeframe. The oldest SAR was over 23 months.

Secretary of State for the Home Department (Home Office) (1)

21 September 2022, Reprimands, Central government

A reprimand has been issued to the Home Office following investigations that showed between March 2021 and November 2021, they had a significant back log of SARs, amounting to just under 21,000 not being responded to during the statutory timeframe. Complaints to the ICO showed requesters suffered significant distress as a result. As of July 2022, there are just over 3,000 unanswered SARs outside of the legal time limit.

Secretary of State for the Home Department (Home Office)

16 August 2022, Reprimands, Central government

A Home Office employee contacted members of the public as part of the creation of an education programme for staff into the historical background and circumstances of individuals arriving into the UK which had led to the matter that became widely and collectively known as the “Windrush scandal” occurring. It is my understanding that interviews were conducted with individuals who had previously been affected by the ”scandal”; that the interviews were recorded on the employee’s personal mobile phone; and subsequently uploaded to her personal YouTube account, from where they were shared with other Home Office employees.

London Borough of Croydon

26 July 2022, Reprimands, Local government

From April 2020 to April 2021, the London Borough of Croydon Council responded to less than half of their SARs within the statutory timescales. This meant that 115 residents did not receive a response in accordance with the UKGDPR. Additionally, since June 2021, the ICO has issued 27 decisions notices under FOIA related to the Council’s failure to respond to information requests. They were issued with a reprimand.

Department of Health and Social Care

11 July 2022, Reprimands, Central government

The ICO has issued the DHSC with a reprimand in relation to data protection compliance matters under the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UKGDPR) and the UK Data Protection Act 2018 (DPA).

The Tavistock & Portman NHS Foundation Trust

30 June 2022, Monetary penalties, Health

Between the period 25 May 2018 to 6 September 2019, the Trust used Outlook to send bulk emails to 1,781 Gender Identity Clinic service users. The Trust failed to comply with Chapter II GDPR, specifically Articles 5(1)(f), and 32(1) & (2).

North Yorkshire County Council

07 April 2022, Reprimands, Local government

An NYCC employee failed to accurately complete the print to post process and as a result two envelopes containing multiple letters were sent to two different recipients.

Epsom and St Helier University Hospitals NHS Trust

07 April 2022, Reprimands, Health

incorrect test result data was passed by Epsom & St Helier University Hospitals NHS Trust (the Trust) to Public Health England (PHE) resulting in individuals erroneously being contacted via the NHS Test and Trace (NHS T&T) system and advised to isolate.

NHS National Services Scotland (NHS NSS)

24 February 2022, Reprimands, Health

The Scottish Government and NHS National Services Scotland (NHS NSS) has been issued with a reprimand in accordance with Article 58(2)(b) of the UK General Data Protection Regulation.