Enforcement action

The Central Young Men’s Christian Association

30 April 2024, Reprimands, Charitable and voluntary

The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealing the email addresses to all recipients. 166 individuals could be identified or potentially identified from their email address. As a result, it could be inferred that these individuals were likely to be living with HIV. The Central YMCA have been fined £7,500 and issued a reprimand.

Clyde Valley Housing Association

18 April 2024, Reprimands, Land or property services

Clyde Valley Housing Association have received the following reprimand because of an infringement that occurred in July 2022 when they released a new customer portal. This portal included personal data of data subjects and residents found they were able to view personal information such as names and addresses about other residents. A resident reported this to Clyde Valley Housing Association, however this concern was not escalated appropriately which led to data remaining viewable on the portal for a further 5 days until further residents reported the issue and Clyde Valley Housing Association suspended the portal.

University Hospital of Southampton NHS Foundation Trust

05 April 2024, Reprimands, Health

A reprimand is being issued to University Hospital of Southampton NHS Foundation Trust as they have only responded to 59% of incoming SARs within the statutory timeframe during the period of 01 August 2022 to 01 July 2023.

Dover Harbour Board

15 March 2024, Reprimands, Criminal justice

A reprimand is being issued to Dover Harbour Board in respect of the creation and use of a social media distribution group, initially created in WhatsApp but later migrated to Telegram. From the evidence provided to the ICO, the distribution groups were used by multiple UK police forces and international law enforcement agencies for the purpose of combatting vehicle crime. The distribution groups were created by an officer from the Port of Dover Police using his personal mobile phone without organisational oversight or compliance with data protection legislation.

Chief Constable of Kent Police

15 March 2024, Reprimands, Criminal justice

A reprimand is being issued to Kent Police in respect of an incident in February 2021 when a Kent Police officer took a photograph of an individual’s identity document using her personal mobile phone and uploaded the image onto Telegram, a social media application. From the evidence provided to the ICO, the Telegram distribution group onto which the image was uploaded was being used by multiple UK police forces and international law enforcement agencies for the purpose of combatting vehicle crime. The Kent Police officer did not inform the individual that further processing of his personal data would take place; how it would be processed; or the purpose for doing so.

Mayor’s Office for Policing and Crime (MOPAC)

13 March 2024, Reprimands, Local government

Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 November 2022, a member of GLA intended to give four members of MOPAC permission to the webforms. However, instead of granting permission to the four members of MOPAC, they made two web forms public. On 23 February 2023 MOPAC were made aware by a member of the public that it was possible for users to click a button that would enable users to access information on every query that had been submitted via the form. 394 people were later notified of the breach due to the nature of the personal data that was made publicly accessible on the forms.

Chief Constable West Midlands Police

01 March 2024, Reprimands, Criminal justice

A reprimand has been issued to West Midlands Police after the force repeatedly incorrectly linked and merged the records of two individuals with similar personal data. West Midlands Police failed to ensure the accuracy of the personal data of these two individuals, resulting in multiple incidents where officers attended a wrong address, including on one occasion when there were serious safeguarding concerns relating to one of the individuals.

Chief Constable Devon and Cornwall Police

02 February 2024, Reprimands, Criminal justice

Chief Constable Devon and Cornwall Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years. In this case, Devon and Cornwall Police have had a subject access request backlog since 2018 which has resulted in a large number of subject access requests not being responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.

Chief Constable Dorset Police

02 February 2024, Reprimands, Criminal justice

Chief Constable Dorset Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years. In this case, Dorset Police have had a subject access request backlog since 2018 which has resulted in a large number of subject access requests not being responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.

South Tees Hospitals NHS Trust

20 December 2023, Reprimands, Health

The reprimand was issued as the South Tees Hospitals NHS Trust (the Trust) was found to have not ensured that its staff were fully trained and prepared to deal with correspondence that was particularly sensitive, and which had been referred to the Trust via legitimate but unusual channels. Staff were not provided with appropriate guidance to ensure that they could deal with sensitive correspondence in every situation. The effect of the infringement was that significant distress was caused to the family of a child patient at a time that was already particularly traumatic for the family.

Finham Park Multi Academy Trust

07 December 2023, Reprimands, Education and childcare

Finham Park Multi Academy Trust have been issued a Reprimand in respect of Articles 5 (1) (f) and 32 (1) (b). An unauthorised third party utilised compromised credentials to access and encrypt Finham Park’s systems. 1843 UK Data Subjects were affected by the incident, and the ICO’s investigation found Finham Park did not have adequate account lockout or password policies in place.

Bank of Ireland

30 November 2023, Reprimands, Finance insurance and credit

BOI failed to ensure the accuracy of customers’ default loan status which led to inaccurate personal data being held on their account which was subsequently incorrectly recorded on customers’ credit profile.

Charnwood Borough Council

29 November 2023, Reprimands, Local government

Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abuse against the data subject. This caused significant distress to the data subject and has the potential to result in actual harm. In addition, the investigation highlighted that the process to make address changes was not properly communicated to the data subject, and that there was an absence of a written and well communicated process for dealing with correspondence in these sensitive circumstances for staff to use. In addition, the Council had not ensured that all members of staff involved in this incident had received data protection training in the twelve months prior to the incident.

NHS Fife

23 November 2023, Reprimands, Health

The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Fife, after an unauthorised individual was able to enter a ward and access the personal information of 14 patients.

GRS (Roadstone) Limited

14 November 2023, Reprimands, General business

The Information Commissioner (the Commissioner) issues a reprimand to GRS (Roadstone) Limited in respect of infringements of Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised Threat Actor being able to exfiltrate the individual personal data of current and former employees.

University Hospital of Derby and Burton NHS Trust (UHDB)

30 October 2023, Reprimands, Health

UHDB failed to have adequate processes in place, especially when processing special category data, which resulted in referrals for out-patients’ appointments not being processed in a timely manner. In some cases, this led to delays of up to two years before medical treatment was arranged.

Police Service of Northern Ireland (PSNI)

26 October 2023, Reprimands, Criminal justice

PSNI failed to have appropriate measures in place to prevent unlawful sharing of personal data including criminal data with the United States Department of Homeland Security (DHS).

Gap Personnel Holdings Limited

19 October 2023, Reprimands, General business

The Information Commissioner (the Commissioner) issues a reprimand to Gap Personnel Holdings Limited in respect of infringements of Article 32 (1), Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised threat actor being able to access individuals personal data twice within a 12-month period.

Optionis Group Limited

10 October 2023, Reprimands, Finance insurance and credit

The data controller suffered a ransomware attack, which resulted in the exfiltration of personal data. A reprimand was issued in respect of specific infringements of the UK GDPR, which include lack of multi-factor authentication, an inadequate account lockout policy, and no clear Bring Your Own Device policy.

Chief Constable West Mercia Police and Chief Constable Warwickshire Police

06 October 2023, Reprimands, Criminal justice

On 21 June 2021 West Mercia Police and Warwickshire Police erroneously decommissioned a server containing a Warwickshire Police application. This application contained Warwickshire Police data from between November 2001 and early 2014. The data which has been lost on this application is unrecoverable.

Nottinghamshire County Council

27 September 2023, Reprimands

A social worker sent copies of a Child and Family Assessment report to the mother and her two ex-partners: each the father of one of her two children. The report contained sensitive personal data which should have been redacted from the copies sent to the partners. The material disclosed related to previous domestic violence enacted on the mother and the two children. This disclosure put the mother and the two children at risk of actual physical harm and created a volatile and dangerous situation between the parties. A reprimand has therefore been issued to Nottinghamshire County Council in relation to an infringement of Article 32(1) of the UK General Data Protection Regulation (UK GDPR).

Ministry of Justice

08 September 2023, Reprimands, Criminal justice

Status: Ongoing The Information Commissioner (the Commissioner) issues a reprimand to the Ministry of Justice (the MoJ) in accordance with Article 58(2)(b) of the UK General Data…

Gloucester City Council

01 September 2023, Reprimands, Local government

The Information Commissioner (the Commissioner) issues a reprimand to Gloucester City Council in respect of infringements of Article 32(1)b, Article 32(1)c and Article 32(1)d of the UK GDPR. Gloucester City Council failed to implement appropriate technical and organisational measures to properly secure their systems.

London Borough of Lewisham

16 August 2023, Reprimands, Local government

During the period of 3 January 2022 to 3 January 2023, 35% of subject access requests (SARs) that London Borough of Lewisham received were not responded to within the statutory deadlines of one and three months. A reprimand has therefore been issued to London Borough of Lewisham in relation to infringements of Article 12(3) and Article 15(1) of the UK General Data Protection Regulation (UK GDPR).

Swinburne, Snowball and Jackson

12 August 2023, Reprimands, Legal

The Information Commissioner (the Commissioner) issues a reprimand to Swinburne, Snowball and Jackson in respect of infringements of Article 5(1)(f), which requires personal data is processed securely, and Article 32(1)(b) of the UK GDPR, which requires appropriate measures are in place to ensure a level of security appropriate to the risk and ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.

Recruitment company reprimand

09 August 2023, Reprimands, General business

The Information Commissioner (the Commissioner) issues a reprimand to a recruitment company in respect of infringements of Article 5(1)(f) and 32(1)(b) of the UK GDPR. The organisation misconfigured a storage container, containing 12,000 records and relating to 3,000 workers, to be publicly accessible without any requirement to authenticate.

NHS Lanarkshire

31 July 2023, Reprimands, Health

The Information Commissioner (the Commissioner) issues a reprimand to NHS Lanarkshire in accordance with Article 58 (2)(b) of the UK General Data Protection Regulation (UK GDPR) for the sharing of personal data of patients via unauthorised means and secondly, a disclosure of personal data.

My Media World Limited t/a Brand New Tube

25 July 2023, Reprimands, Media

Reprimand has been issued to the above organisation in respect of Article 32 (1) and Article 32 (1) (d) of the GDPR. My Media World Limited failed to implement appropriate technical security and organisational measures to properly secure their systems, resulting in unauthorised access to their systems and the exfiltration of personal data relating to 345,000 UK Data Subjects.

Executive Office

21 July 2023, Reprimands, Central government

On 22 May 2020, the Interim Advocate’s Office sent a newsletter by email to 251 subscribers on its mailing list using the ‘To’ field. The email addresses of the recipients were visible to all who received the email.

The Patient and Client Council

19 July 2023, Reprimands, Health

A reprimand has been issued to The Patient and Client Council in relation to infringements of Article 5 (1)(f) and Article 32 (1) of the UK GDPR. The infringements were identified following an investigation into the disclosure of special category due to an email sent to 15 individuals using carbon copy (CC) rather than blind carbon copy (BCC).

Nottinghamshire Police

21 June 2023, Reprimands, Criminal justice

The breach in this case was an unauthorised disclosure of the personal data of witnesses via a police officer’s unredacted statement on the CPS Digital Case Management system. The evidence has revealed that in this instance, the cause of the disclosure of the personal data of witnesses was the failure to ensure the adequate redaction of the data before disclosing this to the CPS.

Thames Valley Police

30 May 2023, Reprimands, Criminal justice

The Information Commissioner (the Commissioner) issues a reprimand to Thames Valey Police (TVP) in accordance with Schedule 13(2)(c) of the Data Protection Act 2018 (DPA 2018) in respect of certain infringements of the DPA 2018.

Parkside Community Primary School

23 May 2023, Reprimands, Education and childcare

A reprimand has been issued to Parkside Community Primary School in relation to the infringements of Article 5 (1)(f), Article 24 (1) and Article 32 of UK GDPR.

Norfolk County Council

05 May 2023, Reprimands, Local government

Norfolk County Council has only responded to 260 out of 511 SARs it received within the statutory timescales from 6 April 2021 to 6 April 2022.

Plymouth City Council

28 April 2023, Reprimands, Local government

A reprimand has been issued to Plymouth City Council in relation to the infringements of Article 12 (3) and Article 15 of the UK GDPR. This case forms part of the ICO’s wider work into Subject Access Request compliance.

Ministry of Justice

27 April 2023, Reprimands, Central government

14 bags of confidential waste were found in an unsecured holding area in the prison, which both prisoners and staff had access to.

University Hospitals Dorset NHS Foundation Trust

25 April 2023, Reprimands, Health

The Information Commissioner (the Commissioner) issues a reprimand to University Hospitals Dorset NHS Foundation Trust (the Trust) in accordance with Article 58(2)(b) of the UK General Data Protection Regulation in respect of certain infringements of the UK GDPR.

Sussex Police

03 April 2023, Reprimands, Criminal justice

In June 2020, the ICO became aware that staff members across both Sussex Police and Surrey Police had access to an app that recorded all incoming and outgoing phone calls. 1,015 staff members downloaded the app onto their work mobile phones and more than 200,000 recordings of phone conversations, likely with victims, witnesses, and perpetrators of suspected crimes, were automatically saved. The ICO considered it highly likely that the app captured a large variety of personal data during these calls and it considered that the processing of some of this data was unfair and unlawful. Police officers that downloaded the app were unaware that all calls would be recorded, and people were not informed that their conversations with officers were being recorded. The app has now been withdrawn from use and the recordings, other than those considered to be evidential material, have been destroyed.

Surrey Police

03 April 2023, Reprimands, Criminal justice

In June 2020, the ICO became aware that staff members across both Sussex Police and Surrey Police had access to an app that recorded all incoming and outgoing phone calls. 1,015 staff members downloaded the app onto their work mobile phones and more than 200,000 recordings of phone conversations, likely with victims, witnesses, and perpetrators of suspected crimes, were automatically saved. The ICO considered it highly likely that the app captured a large variety of personal data during these calls and it considered that the processing of some of this data was unfair and unlawful. Police officers that downloaded the app were unaware that all calls would be recorded, and people were not informed that their conversations with officers were being recorded. The app has now been withdrawn from use and the recordings, other than those considered to be evidential material, have been destroyed.

Achieving for Children

03 April 2023, Reprimands, Social care

Due to communication failure and a lack organisational measures, AfC inappropriately disclosed personal data, special category data and criminal conviction data in a report.

Gain Capital UK Limited

10 March 2023, Reprimands, Online technology and telecoms

Gain Capital UK have been issued a Reprimand in respect of Articles 32 (2) and 32 (1) (b). An unauthorised third party leveraged an unpatched software vulnerability to access Gain Capital’s systems and exfiltrate personal data relating to 72,361 UK Data Subjects. Gain Capital had a support contract in place with a third party whom they believed were responsible for notifying Gain Capital about software security updates, however the contract stipulated that upgrades were Gain Capital’s responsibility.

NHS Highland

09 March 2023, Reprimands, Health

A formal reprimand has been issued to NHS Highland, which emailed 37 people likely to be accessing HIV services, inadvertently using CC (carbon copy) instead of BCC (blind carbon copy). The error meant recipients of the email could see the personal email addresses of other people receiving the email, with one person confirming they recognised four other individuals, one of whom was a previous sexual partner.

University Hospitals Bristol and Weston NHS Foundation Trust

07 March 2023, Reprimands, Health

Patient records were saved on to an Electronic Document Viewing System. The Trust decided to terminate the use of this system and the records on it were downloaded prior to allowing the system licence to expire. However this download was not fully successful but this was not investigated prior to the licence expiry and therefore a number of records became inaccessible and some permanently lost.

NHS Blood and Transplant

03 March 2023, Reprimands, Health

The Commissioner has decided to issue NHSBT with a reprimand in accordance with Article 58 of the GDPR, after they inadvertently released untested development code into a live system for matching transplant list patients with donated organs in August 2019.

Metropolitan Police Service

02 March 2023, Reprimands, Criminal justice

MPS was unable to ensure that sensitive criminal records were not able to be uploaded correctly to the Police National Database (PND), or amended, or deleted and that this situation had been in place, unknown to MPS for some considerable time. The consequences of this failure cannot be measured but had the potential to cause significant damage. Of particular concern was that, even though PND had been operational since 2011 MPS had not developed any automated system of checks to ensure that the vast number of criminal record files that were uploaded daily to PND were correctly loaded. In the response to enquiries, MPS described the system of checks at the time of the incident as “immature”. This is concerning given the length of time that PND had been operational when the incident was discovered.

Chartered Institute for Securities & Investment

21 February 2023, Reprimands

An unauthorised third party exploited a known vulnerability in the Sitefinity software to leverage a bruteforce attack to upload a malicious code to the Chartered Institute for Securities & Investment (CISI)’s website checkout page. The code captured payment details of an estimated 3,883 UK Data Subjects, as well as other personal data including names and email addresses. CISI instructed a third party to conduct a forensic investigation which found that CISI were running unsupported software which had a number of vulnerabilities, one of which was a critical vulnerability for which a security patch had been available since 2017. CISI also advised that no penetration tests had been conducted prior to the incident, and that 654 Data Subjects had reported fraudulent activities on the payment cards affected by the incident. CISI may have missed opportunities to identify the data breach earlier, as a number of individuals had reported card fraud prior to a group notification 14 April 2020, at which point CISI conducted a full investigation.

Power Leisure Bookmakers Limited

06 December 2022, Reprimands

The ICO has issued PLB with a reprimand, in accordance with Article 58 of the UK GDPR, following breaches reported to the ICO on 27 August 2021, 3 September 2021, 9 June 2022, and 7 July 2022.

Royal Free London NHS Foundation Trust

10 November 2022, Reprimands, Health

Hysteroscopy scans were saved on to a series of three USB sticks over a period of nine years from May 2013 until the remaining two encrypted USB sticks became inaccessible on 5 April 2018. It is unknown whether this inaccessibility was as a result of a technical failure of the USBs or human error from inputting the wrong password.

Department for Education

02 November 2022, Reprimands, Central government

The DfE permitted third party access to the LRS database outside of the DfE and subsequent processing took place of some of that personal data (including children) for the purposes of age verification, without appropriate control or oversight. The investigation has found that therefore the personal data on the LRS database was processed in an insecure manner and for purposes that were not initially intended. Furthermore, the DfE failed to be transparent about that processing.

Department for Work and Pensions

31 October 2022, Reprimands

A reprimand has been issued after the inappropriate disclosure of individuals personal data by Child Maintenance Appeals (CM Appeals) within the Department for Work and Pensions (DWP). DWP implemented the Xerox Reprographics application into CM Appeals to handle and redact CM Appeals bundles. No testing or data protection impact assessment (DPIA) was completed before implementing the application into CM Appeals. This is because DWP did not consider it necessary due to the application already being used in other service areas of DWP (such as Personal Independent Payment (PIP) Appeals). However, the redaction requirements for CM appeals are different from the other service areas the application was already implemented in. As such, the redaction functionality of the application was not tested to confirm it was compatible with CM Appeals. This resulted in CM Appeals bundles being sent to individuals unredacted, resulting in the personal data of 16 data subjects being inappropriately disclosed to third parties.