Enforcement action

United Lincolnshire Teaching Hospitals NHS Trust

19 December 2024, Reprimands, Health

A reprimand was issued to United Lincolnshire Teaching Hospitals NHS Trust as during the period between 01 March 2021 to 31 March 2022, it had failed to respond to 32% of Subject Access Requests within the statutory timeframe of one calendar month, thereby infringing Articles 12(3), 15(1) and 15(3) of the UK GDPR.

Money Bubble Ltd EN

12 December 2024, Enforcement notices, General business

It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to the ICO and TPS. MBL did not provide evidence that anyone whose number had been called had consented to receiving calls from the company. The ICO has issued a £120,000 fine.

Money Bubble Ltd MPN

12 December 2024, Monetary penalties, General business

It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to the ICO and TPS. MBL did not provide evidence that anyone whose number had been called had consented to receiving calls from the company. The ICO has issued a £120,000 fine.

Breathe Services Ltd

12 December 2024, Enforcement notices

Breathe Services Ltd (BSL), a debt advice company based in Bolton, first came to the attention of the ICO as part of a wider investigation into complaints received about unsolicited phone calls to potentially vulnerable individuals. In a failed attempt to hide their real identity, BSL was found to have spoofed its outbound phone number by presenting over 1,000 different telephone numbers on calls. In March 2023 the ICO carried out a search at BSL’s office in Bolton, seizing evidence including documents and electronic devices. Our extensive investigation revealed that between March - July 2022 and October - December 2022, BSL bombarded people with 4,376,037 unsolicited direct marketing calls to numbers that had been registered to the Telephone Preference Service (TPS). This resulted in 58 complaints to the TPS and a further 193 complaints to the ICO.

Breathe Services Ltd

12 December 2024, Monetary penalties

Breathe Services Ltd (BSL), a debt advice company based in Bolton, first came to the attention of the ICO as part of a wider investigation into complaints received about unsolicited phone calls to potentially vulnerable individuals. In a failed attempt to hide their real identity, BSL was found to have spoofed its outbound phone number by presenting over 1,000 different telephone numbers on calls. In March 2023 the ICO carried out a search at BSL’s office in Bolton, seizing evidence including documents and electronic devices. Our extensive investigation revealed that between March - July 2022 and October - December 2022, BSL bombarded people with 4,376,037 unsolicited direct marketing calls to numbers that had been registered to the Telephone Preference Service (TPS). This resulted in 58 complaints to the TPS and a further 193 complaints to the ICO.

Southend-on-Sea City Council

17 October 2024, Reprimands, Local government

We issued a reprimand to Southend-on-Sea City Council in Essex after hidden data on a spreadsheet released as part of a freedom of information request revealed the sensitive personal details of staff

Quick Tax Claims Limited

15 October 2024, Enforcement notices

An ICO investigation revealed that Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting in 66,793 complaints – 93% of these stating there was no ‘opt out’ option. During the investigation, the ICO found that the company had purchased personal information from third-party suppliers that did not obtain valid consent. This led to the ICO issuing Quick Tax Claims Limited with a £120,000 fine.

Quick Tax Claims Limited

15 October 2024, Monetary penalties

An ICO investigation revealed that Quick Tax Claims Limited had sent 7,863,547 unlawful text messages over the course of a month, resulting in 66,793 complaints – 93% of these stating there was no ‘opt out’ option. During the investigation, the ICO found that the company had purchased personal information from third-party suppliers that did not obtain valid consent. This led to the ICO issuing Quick Tax Claims Limited with a £120,000 fine.

National Debt Advice Limited

14 October 2024, Enforcement notices, Finance insurance and credit

National Debt Advice sent 129,902 unsolicited direct marketing text messages to individuals in breach of regulation 22 of PECR resulting in over 4,000 complaints to the 7726 spam reporting service. The company was fined £30,000 and issued with an enforcement notice.

National Debt Advice Limited

14 October 2024, Monetary penalties, Finance insurance and credit

National Debt Advice sent 129,902 unsolicited direct marketing text messages to individuals in breach of regulation 22 of PECR resulting in over 4,000 complaints to the 7726 spam reporting service. The company was fined £30,000 and issued with an enforcement notice.

Levales Solicitors LLP

11 October 2024, Reprimands, Legal

Reprimand issued to Levales Solicitors LLP (‘Levales’) in respect of Articles 32(1)(b) and 32(1)(d). A threat actor accessed Levales’ cloud-based server using legitimate credentials and subsequently published data on the dark web. The incident affected 8,234 UK individuals, of which 863 individuals were deemed at high risk because of the nature of the data involved. The investigation found Levales were not ensuring the ongoing confidentiality of its processing systems and did not implement appropriate organisational measures.

WerepairUK Ltd

10 October 2024, Enforcement notices, Marketing

WerepairUK Ltd made 42,688 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £80,000 and issued with an enforcement notice.

WerepairUK Ltd

10 October 2024, Monetary penalties, Marketing

WerepairUK Ltd made 42,688 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £80,000 and issued with an enforcement notice.

Service Box Group Limited

10 October 2024, Monetary penalties, Marketing

Service Box Group Limited made 5,361 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £40,000 and issued with an enforcement notice.

Service Box Group Limited

10 October 2024, Enforcement notices

Service Box Group Limited made 5,361 marketing calls to individuals in breach of regulation 21 of PECR. The company has been fined £40,000 and issued with an enforcement notice.

Police Service of Northern Ireland

03 October 2024, Monetary penalties

The Police Service of Northern Ireland has been fined £750,000 for infringing Articles 5(1)(f), 32(1) and (2) of the UK GDPR between 25 May 2018 and 14 June 2024.

Bonne Terre Limited t/a Sky Betting and Gaming

17 September 2024, Reprimands, Online technology and telecoms

We issued a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, for unlawfully processing people’s data through advertising cookies without their consent.

The Labour Party

28 August 2024, Reprimands, Political

The Labour Party were issued with a reprimand for failing to respond to people’s request for their own personal data, also know as a subject access request, and for failing to respond to peoples request for erasure.

Coastal Windows & Conservatories (UK) Limited

15 August 2024, Enforcement notices, Retail and manufacture

Coastal Windows & Conservatories Limited made over 18,000 unsolicited marketing calls between 1 January and 1 June 2023 to numbers registered with the TPS. The ICO and TPS received numerous complaints from people variously saying they had not consented to receiving such calls or received repeated calls despite requests to stop.

Coastal Windows & Conservatories (UK) Limited

15 August 2024, Monetary penalties, Retail and manufacture

Coastal Windows & Conservatories Limited made over 18,000 unsolicited marketing calls between 1 January and 1 June 2023 to numbers registered with the TPS. The ICO and TPS received numerous complaints from people variously saying they had not consented to receiving such calls or received repeated calls despite requests to stop.

The Electoral Commission

30 July 2024, Reprimands, Central government

Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately 40,000,000 individuals, and the initial access was gained via several unpatched software vulnerabilities. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.

Chelmer Valley High School

22 July 2024, Reprimands, Education and childcare

Chelmer Valley High School have been issued a reprimand in respect of Article 35(1). The school failed to complete a Data Protection Impact Assessment (DPIA) prior to introducing facial recognition technology for the purposes of cashless catering.

London Borough of Hackney

05 July 2024, Reprimands, Local government

The Information Commissioner’s Office has issued the London Borough of Hackey with a reprimand following a cyber-attack in 2020 that led to hackers gaining access to and encrypting 440,000 files, affecting at least 280,000 residents and other individuals including staff.

Birmingham Children's Trust Community Interest Company

14 May 2024, Reprimands

Reprimand issued to Birmingham Children’s Trust Community Interest company in respect of Article 5(1)(f) and 32(1)(b) and 2. A child protection plan containing inappropriate personal data, in the form of criminal allegations against a child, was sent to the family the plan was produced for. Although the care plan itself was authorised for the family to view, the criminal allegations were not relevant to the plan, or authorised for the family’s view. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.

The Central Young Men’s Christian Association

30 April 2024, Reprimands, Charitable and voluntary

The Central YMCA sent an email to individuals participating in a programme for people living with HIV using “CC” rather than “BCC”, revealing the email addresses to all recipients. 166 individuals could be identified or potentially identified from their email address. As a result, it could be inferred that these individuals were likely to be living with HIV. The Central YMCA have been fined £7,500 and issued a reprimand.