Skip to content

ICO Fines for Accidental GDPR Breaches

Table of Contents

 

You may be aware of the Information Commissioner’s Office’s (ICO) power to fine UK organisations up to £17.5m for breaches of data protection law.  However, some company owners mistakenly believe that the ICO will only financially penalise businesses for intentional misconduct.  Unfortunately, this is not necessarily the case. This article will consider the extent of your liability for accidental GDPR breaches related to an ICO fine. This, in turn, will help you appreciate why you should take steps to avoid ICO fines.    

What is the ICO?

The UK Government created the ICO to enforce data protection rules against UK organisations. One of the ICO’s main objectives is to ensure that UK businesses comply with data protection rules. They do help businesses do so by providing helpful online guidance. To this end, the law gives the ICO board powers to enforce data protection laws. This includes the levy of hefty penalties on businesses that break data protection rules.

The primary law the ICO enforces is the General Data Protection Regulation (GDPR).  Whilst the ICO can impose fines for breach of any part of the GDPR, the most common penalties occur when a UK organisation:

  1. fails to store personal information safely;
  2. suffers an avoidable cyber attack leading to loss of personal data;
  3. discloses personal information to third parties without lawful reason;
  4. exposes individuals (including staff and members of the public) to unreasonable monitoring methods; or
  5. does not provide personal data upon reasonable request (including subject access requests).

What is GDPR?

The UK General Data Protection Regulation (GDPR) is the primary data protection law in the UK.  It makes clear that UK organisations should collect personal information for lawful purposes only. Where businesses collect personal data, they should ensure they store it safely, securely, and only for as long as necessary.

Continue reading this article below the form
Need legal advice?
Call 0808 196 8584 for urgent assistance.
Otherwise, complete this form and we will contact you within one business day.

What Are the Biggest Recorded ICO Fines?

The ICO has made headlines over the years with their hefty financial penalties against UK organisations.  In fact, during 2020 and 2021, the ICO handed down fines of over £40m.

Whilst most ICO fines will be in the region of thousands or tens of thousands of pounds, the most considerable penalties are in the millions.  Examples of some huge ICO fines include:

  1. British Airways £20m fine – BA suffered a cyber attack that leaked the details of nearly half a million customers in 2018;
  2. Marriott Hotels £18.4m fine – the hotel chain took four years to realise that a cyber attack had occurred in 2014, which led to guests losing their contact and passport details;
  3. Clearview AI £7.5m fine – the company collected personal images of individuals for their global face recognition network without prior consent; and
  4. Ticketmaster £1.25m fine – the company failed to implement appropriate security on its electronic payment page, leading to the theft of credit card information relating to 1.5 million people.

Naturally, the ICO investigation imposed such hefty fines due to the scale of the harm caused and the number of people impacted.

Liability for Accidental Breaches

We all may have differing interpretations of what counts as an accidental GDPR breach. But generally, accidental GDPR breaches describe conduct that, while technically amounting to a breach of the law, was not undertaken with the intention to do so. 

For example, consider that accountancy aims to send a set of accounts to their client, Super Fast Lorries Limited.  However, they mistakenly send it to a different company, starting with the letter ‘s’. This can be an easy mistake when using email software that aims to autofill email address information!

This would constitute an innocent or accidental error because it wasn’t an intentional mistake nor due to an unreasonable company policy.  

But does the fact that this was an accidental breach of DGPR protect the company from an ICO fine?

The answer is, unfortunately, not. Legally, accidental GDPR breaches often amount to negligence. Accordingly, the ICO calculates fines based on the harm caused to individuals by leaking personal information.  If those accounts contained personal data relating to individuals, such as their salary, national insurance numbers and home addresses, it would be a serious personal data breach! Accordingly, the ICO may assess a fine against the accountancy. 

Front page of publication
UK Startup Manual

LegalVision’s Startup Manual is essential reading material for any startup founder looking to launch and grow a successful startup.

Download Now

Key Takeaways

As with most things, the best policy is prevention rather than cure.  The ICO’s website contains helpful guides to ensuring good GDPR compliance and minimising the risk of serious mistakes.  Many business owners carry out annual data protection audits to assess risk areas, and expert lawyers can help put proper procedures in place.

If you need help with GDPR compliance and correspondence with the ICO, our experienced Data, Privacy and IT lawyers can assist as part of our LegalVision membership.  For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents.  Call us today on 0808 196 8584 or visit our membership page.  

Frequently Asked Questions

How often does the ICO issue monetary fines to UK organisations?

Whilst the ICO only awards fines in the millions on rare occasions, it routinely hands down penalties in the thousands or tens of thousands of pounds for serious offences.

Why can the ICO issue such hefty fines?

The ICO can issue massive financial penalties to deter UK organisations from taking data protection lightly.  Since introducing the GDPR, most UK businesses have taken proactive steps to avoid the risk of substantial fines.

Register for our free webinars

Selling a Business: Tips for a Successful Sale

Online
Selling your business? Learn essential tips to reduce risk and achieve a successful sale. Register for our free webinar today.
Register Now

How to Recover Unpaid Debts from Customers and Suppliers

Online
Struggling with unpaid debts? Discover your options. Register for our free webinar today.
Register Now

Preventing Employee Competitors: How to Protect Your Business

Online
Learn how to protect your business from employee competitors. Register for our free webinar today.
Register Now

Protecting and Enforcing Your Brand

Online
Protect your brand from misuse and infringement. Register for our free webinar.
Register Now
See more webinars >
Thomas Sutherland

Thomas Sutherland

Read all articles by Thomas

About LegalVision

LegalVision is an innovative commercial law firm that provides businesses with affordable, unlimited and ongoing legal assistance through our membership. We operate in Australia, the United Kingdom and New Zealand.

Learn more

We’re an award-winning law firm

  • Award

    2024 Law Company of the Year Finalist - The Lawyer Awards

  • Award

    2024 Law Firm of the Year Finalist - Modern Law Private Client Awards

  • Award

    2023 Economic Innovator of the Year Finalist - The Spectator

  • Award

    2023 Law Company of the Year Finalist - The Lawyer Awards

  • Award

    2023 Future of Legal Services Innovation - Legal Innovation Awards