The Information Commissioner’s Office has published new data protection fining guidance setting out how it decides to issue penalties and calculate fines.
The guidance provides greater transparency for organisations about how the ICO goes about using its fining power.
Tim Capel, ICO Director of Legal Service, said:
“We believe the guidance will provide certainty and clarity for organisations.
It shows how we reach one of our most important decisions as a regulator by explaining when, how and why we would issue a fine for a breach of the UK General Data Protection Regulation or Data Protection Act 2018.”
Publication of the guidance follows a consultation last year, where views were gathered on a draft version.
The new guidance replaces the sections about penalty notices in the ICO Regulatory Action Policy published in November 2018.
Among other things, the guidance explains:
- the legal framework that gives the ICO the power to impose fines –helping people more easily navigate the complexity of the legislation;
- how the ICO will approach key questions, such as identifying the wider ‘undertaking’ or economic entity of which the controller or processor forms part; and
- the methodology the ICO will use to calculate the appropriate amount of the fine.
Notes to editors
- The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
- The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
- The ICO's strategic priorities are set out in ICO25, which includes safeguarding and empowering people, particularly vulnerable groups who are exposed to the greatest risk of harm.
- To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.