The ICO exists to empower you through information.

Camau gorfodi

165 in total

Charnwood Borough Council

29 November 2023, Reprimands, Local government

Reprimand issued for the disclosure of the new address of the data subject to an ex-partner who was the alleged perpetrator of domestic abuse against the data subject. This caused significant distress to the data subject and has the potential to result in actual harm. In addition, the investigation highlighted that the process to make address changes was not properly communicated to the data subject, and that there was an absence of a written and well communicated process for dealing with correspondence in these sensitive circumstances for staff to use. In addition, the Council had not ensured that all members of staff involved in this incident had received data protection training in the twelve months prior to the incident.

NHS Fife

23 November 2023, Reprimands, Health

The Information Commissioner’s Office (ICO) has issued a reprimand to NHS Fife, after an unauthorised individual was able to enter a ward and access the personal information of 14 patients.

GRS (Roadstone) Limited

14 November 2023, Reprimands, General business

The Information Commissioner (the Commissioner) issues a reprimand to GRS (Roadstone) Limited in respect of infringements of Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised Threat Actor being able to exfiltrate the individual personal data of current and former employees.

University Hospital of Derby and Burton NHS Trust (UHDB)

30 October 2023, Reprimands, Health

UHDB failed to have adequate processes in place, especially when processing special category data, which resulted in referrals for out-patients’ appointments not being processed in a timely manner. In some cases, this led to delays of up to two years before medical treatment was arranged.

Police Service of Northern Ireland (PSNI)

26 October 2023, Reprimands, Criminal justice

PSNI failed to have appropriate measures in place to prevent unlawful sharing of personal data including criminal data with the United States Department of Homeland Security (DHS).

Argentum Data Solutions Ltd

26 October 2023, Enforcement notices, General business

Between 1 January 2021 and 31 January 2022 there were a total of 2,330,423 SMS sent without consent. 24,309 were sent by ADS directly and it allowed its lines to be used by third parties to send the remaining 2,306,114. These messages were sent in breach of regulation 22 of PECR. ADS came to our attention following a review of complaints received by the 7726 spam reporting tool.

Argentum Data Solutions Ltd

26 October 2023, Monetary penalties, General business

Between 1 January 2021 and 31 January 2022 there were a total of 2,330,423 SMS sent without consent. 24,309 were sent by ADS directly and it allowed its lines to be used by third parties to send the remaining 2,306,114. These messages were sent in breach of regulation 22 of PECR. ADS came to our attention following a review of complaints received by the 7726 spam reporting tool.

Gap Personnel Holdings Limited

19 October 2023, Reprimands, General business

The Information Commissioner (the Commissioner) issues a reprimand to Gap Personnel Holdings Limited in respect of infringements of Article 32 (1), Article 32 (1) (b) and Article 32 (1) (d) of the UK GDPR. The organisation did not have appropriate security measures in place, which resulted in an unauthorised threat actor being able to access individuals personal data twice within a 12-month period.

Optionis Group Limited

10 October 2023, Reprimands, Finance insurance and credit

The data controller suffered a ransomware attack, which resulted in the exfiltration of personal data. A reprimand was issued in respect of specific infringements of the UK GDPR, which include lack of multi-factor authentication, an inadequate account lockout policy, and no clear Bring Your Own Device policy.

Chief Constable West Mercia Police and Chief Constable Warwickshire Police

06 October 2023, Reprimands, Criminal justice

On 21 June 2021 West Mercia Police and Warwickshire Police erroneously decommissioned a server containing a Warwickshire Police application. This application contained Warwickshire Police data from between November 2001 and early 2014. The data which has been lost on this application is unrecoverable.

Digivo Media Limited

03 October 2023, Enforcement notices, Finance insurance and credit

Between 24 March 2021 and 7 September 2021 there were 415,041 texts delivered without valid consent – breach of Regulation 22 of PECR. Digivo came to the ICO’s attention following a review of debt management complaints received via the SPAM reporting tool.

Digivo Media Limited

03 October 2023, Monetary penalties, Finance insurance and credit

Between 24 March 2021 and 7 September 2021 there were 415,041 texts delivered without valid consent – breach of Regulation 22 of PECR. Digivo came to the ICO’s attention following a review of debt management complaints received via the SPAM reporting tool.

MCP Online Ltd

28 September 2023, Enforcement notices, Finance insurance and credit

Between 1 January 2022 and 28 September 2022 there were 20,939 calls made to CTPS or TPS registered numbers – breach of Reg 21 and 24 of PECR. MCP came to the ICO’s attention following a review of complaints made to the Telephone Preference Service (TPS) in November 2021 as part of Operation Torc, which has been set up to investigate unsolicited pensions calls.

MCP Online Ltd

28 September 2023, Monetary penalties, Finance insurance and credit

Between 1 January 2022 and 28 September 2022 there were 20,939 calls made to CTPS or TPS registered numbers – breach of Reg 21 and 24 of PECR. MCP came to the ICO’s attention following a review of complaints made to the Telephone Preference Service (TPS) in November 2021 as part of Operation Torc, which has been set up to investigate unsolicited pensions calls.

Nottinghamshire County Council

27 September 2023, Reprimands

A social worker sent copies of a Child and Family Assessment report to the mother and her two ex-partners: each the father of one of her two children. The report contained sensitive personal data which should have been redacted from the copies sent to the partners. The material disclosed related to previous domestic violence enacted on the mother and the two children. This disclosure put the mother and the two children at risk of actual physical harm and created a volatile and dangerous situation between the parties. A reprimand has therefore been issued to Nottinghamshire County Council in relation to an infringement of Article 32(1) of the UK General Data Protection Regulation (UK GDPR).

RHAP Ltd

21 September 2023, Enforcement notices, Marketing

RHAP Ltd made 15,288 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £65,000 and issued with an enforcement notice.

RHAP Ltd

21 September 2023, Monetary penalties, Marketing

RHAP Ltd made 15,288 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £65,000 and issued with an enforcement notice.

House Hold Appliances 247 Ltd

21 September 2023, Enforcement notices, Marketing

House Hold Appliances 247 Ltd made 19,069 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £55,000 and issued with an enforcement notice.

House Hold Appliances 247 Ltd

21 September 2023, Monetary penalties, Marketing

House Hold Appliances 247 Ltd made 19,069 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £55,000 and issued with an enforcement notice.

F12 Management Ltd

21 September 2023, Enforcement notices

F12 Management Ltd made 1,346,019 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issued with an enforcement notice.

F12 Management Ltd

21 September 2023, Monetary penalties, Marketing

F12 Management Ltd made 1,346,019 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issued with an enforcement notice.

Cover Appliance Ltd

21 September 2023, Monetary penalties, Marketing

Cover Appliance Ltd made 511,499 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issued with an enforcement notice.

Cover Appliance Limited

21 September 2023, Enforcement notices, Marketing

Cover Appliance Ltd made 511,499 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issued with an enforcement notice.

SGS Home Protect Ltd

21 September 2023, Enforcement notices, Marketing

SGS Home Protect Ltd made 24,214 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £70,000 and issued with an enforcement notice.

SGS Home Protect Ltd

21 September 2023, Monetary penalties, Marketing

SGS Home Protect Ltd made 24,214 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £70,000 and issued with an enforcement notice.