Enforcement action

Clyde Valley Housing Association

18 April 2024, Reprimands, Land or property services

Clyde Valley Housing Association have received the following reprimand because of an infringement that occurred in July 2022 when they released a new customer portal. This portal included personal data of data subjects and residents found they were able to view personal information such as names and addresses about other residents. A resident reported this to Clyde Valley Housing Association, however this concern was not escalated appropriately which led to data remaining viewable on the portal for a further 5 days until further residents reported the issue and Clyde Valley Housing Association suspended the portal.

University Hospital of Southampton NHS Foundation Trust

05 April 2024, Reprimands, Health

A reprimand is being issued to University Hospital of Southampton NHS Foundation Trust as they have only responded to 59% of incoming SARs within the statutory timeframe during the period of 01 August 2022 to 01 July 2023.

Home Office

21 March 2024, Enforcement notices, Central government

An enforcement notice and a warning have been issued to the Home Office for failing to assess the privacy risks posed by the electronic monitoring of people arriving in the UK by unauthorised means. The ICO has been in discussion with the Home Office regarding its pilot to place ankle tags on, and track the GPS location of, up to 600 migrants who arrived in the UK and were on immigration bail. Although the pilot ended in December 2023, the Home Office has retained the GPS location data collected by the tags and will continue to be able to access and use that data including sharing it with other third-party organisations. The enforcement notice orders the Home Office to update its internal policies, access guidance and privacy information in relation to the data retained from the pilot. The warning issued also states that any future processing on the same basis will be in breach of data protection law and will attract enforcement action.

Dover Harbour Board

15 March 2024, Reprimands, Criminal justice

A reprimand is being issued to Dover Harbour Board in respect of the creation and use of a social media distribution group, initially created in WhatsApp but later migrated to Telegram. From the evidence provided to the ICO, the distribution groups were used by multiple UK police forces and international law enforcement agencies for the purpose of combatting vehicle crime. The distribution groups were created by an officer from the Port of Dover Police using his personal mobile phone without organisational oversight or compliance with data protection legislation.

Chief Constable of Kent Police

15 March 2024, Reprimands, Criminal justice

A reprimand is being issued to Kent Police in respect of an incident in February 2021 when a Kent Police officer took a photograph of an individual’s identity document using her personal mobile phone and uploaded the image onto Telegram, a social media application. From the evidence provided to the ICO, the Telegram distribution group onto which the image was uploaded was being used by multiple UK police forces and international law enforcement agencies for the purpose of combatting vehicle crime. The Kent Police officer did not inform the individual that further processing of his personal data would take place; how it would be processed; or the purpose for doing so.

Mayor’s Office for Policing and Crime (MOPAC)

13 March 2024, Reprimands, Local government

Within the London.gov.uk website, there was a webform to contact the London Victims’ Commissioner as well as other webforms. Between 11-14 November 2022, a member of GLA intended to give four members of MOPAC permission to the webforms. However, instead of granting permission to the four members of MOPAC, they made two web forms public. On 23 February 2023 MOPAC were made aware by a member of the public that it was possible for users to click a button that would enable users to access information on every query that had been submitted via the form. 394 people were later notified of the breach due to the nature of the personal data that was made publicly accessible on the forms.

Pinnacle Life Limited

07 March 2024, Enforcement notices, Finance insurance and credit

Between 5 May 2021 to 5 May 2022, there were 47,998 connected calls unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified Pinnacle Life Limited that they were willing to receive such calls, and four complaints being submitted as a result.

Pinnacle Life Limited

07 March 2024, Monetary penalties, Finance insurance and credit

Between 5 May 2021 to 5 May 2022, there were 47,998 connected calls unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified Pinnacle Life Limited that they were willing to receive such calls, and four complaints being submitted as a result.

Penny Appeal

01 March 2024, Enforcement notices

The Information Commissioner’s Office (ICO) has issued an Enforcement Notice to Penny Appeal, for sending 461,650 spam text messages over a ten day period. These messages were sent to a database of individuals who had never agreed to receive marketing communication from Penny Appeal.

Chief Constable West Midlands Police

01 March 2024, Reprimands, Criminal justice

A reprimand has been issued to West Midlands Police after the force repeatedly incorrectly linked and merged the records of two individuals with similar personal data. West Midlands Police failed to ensure the accuracy of the personal data of these two individuals, resulting in multiple incidents where officers attended a wrong address, including on one occasion when there were serious safeguarding concerns relating to one of the individuals.

Ministry of Defence

26 February 2024, Monetary penalties, Central government

The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of GDPR Article 5(1)(f). The MOD were fined £350,000.

Serco Leisure Operating Limited and relevant associated Trusts

23 February 2024, Enforcement notices, Transport and leisure

Serco Leisure, Serco Jersey and seven associated community leisure trusts have been issued enforcement notices ordering them to stop using facial recognition technology and fingerprint scanning to monitor employee attendance. The ICO's investigation found that Serco and the trusts have been unlawfully processing the biometric data of more than 2,000 employees at 38 leisure facilities for the purpose of monitoring attendance.

Chief Constable Devon and Cornwall Police

02 February 2024, Reprimands, Criminal justice

Chief Constable Devon and Cornwall Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years. In this case, Devon and Cornwall Police have had a subject access request backlog since 2018 which has resulted in a large number of subject access requests not being responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.

Chief Constable Dorset Police

02 February 2024, Reprimands, Criminal justice

Chief Constable Dorset Police have continuously infringed Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years. In this case, Dorset Police have had a subject access request backlog since 2018 which has resulted in a large number of subject access requests not being responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.

L.A.D.H Limited

19 January 2024, Enforcement notices, Finance insurance and credit

L.A.D.H Limited sent 31,329 direct market text messages to individuals in breach of regulation 22 and 23 of PECR. The company was fined £50,000 and issued with an enforcement notice.

L.A.D.H Limited

19 January 2024, Monetary penalties, Finance insurance and credit

L.A.D.H Limited sent 31,329 direct market text messages to individuals in breach of regulation 22 and 23 of PECR. The company was fined £50,000 and issued with an enforcement notice.

Crown Prosecution Service

18 January 2024, Enforcement notices, Criminal justice

An Enforcement Notice has been issued to the Crown Prosecution Service in relation to a contravention of the sixth data protection principle in section 40 DPA 2018. The contravention was identified…

Poxell Ltd

16 January 2024, Enforcement notices

Poxell first came to the attention of the Commissioner in April 2022 as part of an investigation formed to assess and analyse complaint trends in relation to the energy and home improvements sector. The investigation established that between 31 March 2022 and 20 July 2022, Poxell made 2,647,805 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 413 complaints to the ICO and TPS reporting tools. Individuals stated calls were about energy products, specifically driveway repairs, windows, doors and insulation. Several complainants reported that they had not consented to receive calls which were persistent in nature, one individual stated they had received over 40 calls, and they thought calls may be a scam.

Poxell Ltd

16 January 2024, Monetary penalties

Poxell first came to the attention of the Commissioner in April 2022 as part of an investigation formed to assess and analyse complaint trends in relation to the energy and home improvements sector. The investigation established that between 31 March 2022 and 20 July 2022, Poxell made 2,647,805 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 413 complaints to the ICO and TPS reporting tools. Individuals stated calls were about energy products, specifically driveway repairs, windows, doors and insulation. Several complainants reported that they had not consented to receive calls which were persistent in nature, one individual stated they had received over 40 calls, and they thought calls may be a scam.

Skean Homes Ltd

16 January 2024, Monetary penalties

Skean first came to the attention of the Commissioner in 2022 as part of an operation formed to assess and analyse complaint trends in relation to the energy and home improvement sector. The Commissioner identified a number of complaints against "Eco Hub", "Driveway Solutions" and "Eco Driveways", in which complainants stated that the calls were promoting energy grants for resin driveways. The investigation established that between 2 March 2022 and 31 May 2022, Skean instigated 614,342 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 31 complaints to the ICO and TPS reporting tools.

Skean Homes Ltd

16 January 2024, Enforcement notices

Skean first came to the attention of the Commissioner in 2022 as part of an operation formed to assess and analyse complaint trends in relation to the energy and home improvement sector. The Commissioner identified a number of complaints against "Eco Hub", "Driveway Solutions" and "Eco Driveways", in which complainants stated that the calls were promoting energy grants for resin driveways. The investigation established that between 2 March 2022 and 31 May 2022, Skean instigated 614,342 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 31 complaints to the ICO and TPS reporting tools.

Grocery Delivery E-Services UK Ltd t/a HelloFresh

12 January 2024, Monetary penalties, Retail and manufacture

The Information Commissioner’s Office (ICO) has fined food delivery company HelloFresh £140,000 for a campaign of 79 million spam emails and 1 million spam texts over a seven-month period. The marketing messages were sent based on an opt-in statement which did not make any reference to the sending of marketing via text, and which was also bundled with an age confirmation statement which was likely to unfairly incentivise customers to agree. Customers were also not given sufficient information that their data would continue to be used for marketing purposes for up to 24 months after cancelling their subscriptions.

South Tees Hospitals NHS Trust

20 December 2023, Reprimands, Health

The reprimand was issued as the South Tees Hospitals NHS Trust (the Trust) was found to have not ensured that its staff were fully trained and prepared to deal with correspondence that was particularly sensitive, and which had been referred to the Trust via legitimate but unusual channels. Staff were not provided with appropriate guidance to ensure that they could deal with sensitive correspondence in every situation. The effect of the infringement was that significant distress was caused to the family of a child patient at a time that was already particularly traumatic for the family.

Finham Park Multi Academy Trust

07 December 2023, Reprimands, Education and childcare

Finham Park Multi Academy Trust have been issued a Reprimand in respect of Articles 5 (1) (f) and 32 (1) (b). An unauthorised third party utilised compromised credentials to access and encrypt Finham Park’s systems. 1843 UK Data Subjects were affected by the incident, and the ICO’s investigation found Finham Park did not have adequate account lockout or password policies in place.

Daniel George Bentley and Taipan Trading Ltd

05 December 2023, Enforcement notices, Marketing

Daniel George Bentley is a sole trader and director of Taipan Trading Ltd. Between 1 May 2022 and 31 July 2023 he and his company sent over 2.5 million unsolicited direct marketing text messages to individuals in breach of regulations 22 and 23 of PECR.