Table of Contents
As a UK business owner, you will likely know the General Data Protection Regulation (UK GDPR). The GDPR was subject to heightened media attention several years ago due to the powers it provided to the Information Commissioner’s Office (ICO). In particular, the GDPR enabled the ICO to fine any UK organisation up to £17.5m for GDPR violations.
This article will explore the potential financial consequences of failing to comply with the GDPR, so your business can enter into decisions regarding data protection with full knowledge of the risks of non-compliance. This should help your organisation prioritise GDPR compliance because the time and costs of doing so are likely less than an ICO fine.
Importance of Complying With the GDPR
The GDPR is the primary data protection law governing the use of ‘personal information’ within the UK. It applies to all organisations in the UK and states that safeguards must be in place when handling personal data.
The GDPR gives a broad definition of ‘personal data’ (or personal information). It defines it as any data that could identify a living individual. Naturally, this includes a myriad of personal information, including:
- health data;
- home address;
- national insurance number;
- car registration number; or
- biometric data.
Any failure to comply with GDPR can lead to a formal investigation by the ICO. Upon any adverse finding, the ICO is not shy in handing down hefty GDPR fines to UK organisations. In fact, over the past decade, the ICO has provided numerous multi-million-pound penalties to UK businesses.
What Powers Do the ICO Have?
The ICO is an independent body that acts to inform UK organisations of GDPR rules and consider financial penalties when they fail to comply with them. Whilst the ICO can provide a warning for any GDPR rule breach, it tends to only do so in instances of a minor, incidental infringement with little harm caused to individuals.
As many unfortunate UK businesses have learnt over the years, the ICO uses its fines as a deterrent against GDPR violations. In this way, it is not uncommon for the ICO to announce fines in the hundreds of thousands or millions of pounds on their website.
Whilst any article on the ICO website announcing a GDPR violation will have a reputational impact on your company, the most pressing concern usually involves payment of a hefty fine. With this in mind, we will explore the potential cost implications of an ICO fine below.
Continue reading this article below the formCall 0808 196 8584 for urgent assistance.
Otherwise, complete this form and we will contact you within one business day.
ICO Fine Levels
The ICO does not have to issue a fine upon finding a GDPR violation. However, it tends to consider doing so in the event of severe breaches. Some examples of potentially severe GDPR violations include:
- unsafe storage of personal data;
- failure to report a serious data breach to the ICO within 72 hours;
- failure to correctly handle Subject Access Requests;
- unreasonable invasions of privacy within your premises (for example, using CCTV cameras without appropriate signage); and
- failure to take reasonable cybersecurity measures, resulting in a preventable cyber attack and the theft of personal data.
As has been widely publicised, the ICO can award financial penalties of up to £17.5m to UK organisations. The level of fine depends on the harm caused to individuals. So, for example, the ICO will award a more significant fine to a UK company that accidentally publishes the home address of 200 customers on its website compared to a business that leaves a handwritten note containing three telephone numbers on a bus. This is because the first scenario affects more individuals and has a broader impact.
Mitigating Circumstances
The ICO consider mitigating circumstances when considering whether to fine your company or how hefty any fine should be.
Your company could potentially put forward some of the following reasons in mitigation:
- it is your organisation’s first GDPR violation;
- your company provides data protection and cybersecurity training to staff;
- the harm to individuals is not severe;
- your company immediately took appropriate action to mitigate the damage to individuals; and
- your business has always sought to comply with data protection law and ICO guidance fully.
Successful mitigation reasons will reduce the ICO’s fine down the maximum fine level to something more palatable.
Key Takeaways
As a starting point, the ICO’s main aim is for UK organisations to comply with GDPR rules. Whilst the ICO can issue hefty fines, this is generally not their primary goal. Instead, the ICO aims to aid GDPR and Data Protection Act compliance through the excellent guidance materials on its website.
However, if your business violates GDPR rules, the ICO will not hesitate to investigate the alleged breach and consider imposing a financial penalty. The ICO has demonstrated its intention to deter non-compliance within recent years through numerous fines in the hundreds of thousands or millions of pounds. With this in mind, many UK business owners have obtained expert legal advice on GDPR compliance and documentation.
If you need help ensuring your business is GDPR compliant, our experienced Data, Privacy and IT lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.
Frequently Asked Questions
Yes, the ICO will acknowledge genuine evidence of mitigation. At best, it may provide you with a warning instead of a fine. For this reason, engaging with the ICO and putting forward mitigating factors is always helpful.
Not necessarily, albeit repeat offenders are at higher risk of receiving substantial fines. The ICO is less likely to value any mitigation evidence (particularly concerning your business trying to comply with GDPR rules) if it has violated those rules before.
We appreciate your feedback – your submission has been successfully received.
