Some interesting facts and statistics on the ICO for the last couple of years. Leading up to the GDPR implementation in the next few months time, the fines are going to increase and every business should be aware of whats upcoming.

The Information Commissioner’s Office (ICO) is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

During 2016/2017 the ICO issued fines topping £3.5 million under the Data Protection Act and Privacy of Electronic Communication Regulations. (1)

The ICO dealt with a record 20,919 data-protection complaints and self-reported incidents across all sectors in that time span to 31st March, a rise of 14% on the previous 12 months. (2)

Data published by the ICO in May 2017 for 2016/17 revealed:

• The ICO dealt with a record 20,919 data-protection complaints and self-reported incidents across all sectors in the year to 31st March, a rise of 14% on the previous 12 months
• In 2016/17 the ICO was alerted to 2,565 breaches of data-protection law by the organisations involved, an increase of 31.5% on the year before
• Of those breaches, 4% – approximately 103 cases – involved charities, making charities the sector with the joint fifth-highest proportion of self-reported incidents, alongside solicitors and policing
• Charities were responsible for 4% of the self-reported data-protection incidents that were handled by the ICO in 2016/17
• The health sector accounted for 41% of self-reported incidents, local government accounted for 11%, general business for 9% and education for 6%
• The ICO finished dealing with 2,445 self-reported incidents in 2016/17 and handed out monetary penalties in 17% of cases
• In 1,680 cases no action was required, in 638 cases the data controller was required to act and in 68 cases an improvement plan was agreed between the ICO and the data controller
• In a statement, the ICO said it had become easier for organisations and the public to alert the regulator to concerns because of its new live chat services and online reporting tool for the public and new self-assessment tools for organisations

The ICO also published statistics about the number of issues it had dealt with in relation to marketing and nuisance calls across all sectors. It received 167,018 complaints about marketing that broke the Privacy and Electronic Communications Regulations 2003 and handed out a record 23 fines, totalling more than £1.92m, for what it called “a range of unlawful marketing activities”. (3)

Since January 2017 the ICO have kept us informed of the developments leading up to the new General Data Protection Regulation (GDPR) enforcement which is due on 25^th May 2018.

• January 2018 – Most recently, there has been more information added about ‘personal data breaches’.
• December 2017 – The ICO published detailed guidance on ‘children and the GDPR’, ‘lawful basis for processing’ and ‘rights’ related to automated individual decision making including profiling. The Article 29 Working Party published guidance on ‘consent’ and ‘transparency’ and guidelines on ‘breach notification and automated decision making’.
• November 2017 – The Article 29 Working Party published guidelines on ‘imposing administrative fines’. They replaced the ‘Overview of the GDPR’ with the ‘Guide to the GDPR’. There was an extended section on ‘consent’, ‘contracts and liabilities’.
• October 2017 – The Article 29 Working Party published the ‘breach notification’ and ‘automated individual decision making and profiling’. In addition to that, guidelines on ‘administrative fines’ and updated the ‘automated decision making and profiling’.
• September 2017 – The ICO put out for consultation the draft GDPR guidance on ‘contracts and liabilities for controllers and processors’.
• July 2017 – In the ‘Key areas to consider’ they updated the next steps in regard to the ICO’s ‘consent’ guidance and the Article 29 Working Party’s Europe-wide ‘consent’ guidelines.
• June 2017 – Added guidelines on ‘high-risk processing’ and ‘data protection impact assessments’.
• May 2017 – Updated the ‘GDPR 12 steps to take now’ document. Added a ‘getting ready for the GDPR checklist’ to the self-assessment toolkit.
• April 2017 – Published the ‘profiling’ discussion paper for feedback.
• March 2017 – Published the draft ‘consent’ guidance for public consultation.
• January 2017 – Published the guidance for ‘data portability’, ‘lead supervisory authorities’ and ‘data protection officers’.

Find out the full details on the ICO’s ‘What’s new?’

ICO fee and registration changes for 2018

As the countdown continues to the implementation of the GDPR taking effect in May this year, the ICO are notifying businesses about the change in fees. Under the current Data Protection Act (DPA), organisations that process personal information are required to notify with the ICO as data controllers (unless an exemption applies). This involves explaining what personal data they collect and what they do with it. They are also required to pay a notification fee, based on their size, of either £35 or £500.