Password manager provider LastPass has been hit with a £1.2 million fine for failing to prevent a massive data breach.

The Information Commissioner's Office (ICO) found that a combination of two incidents over two days in August 2022 put more than 1.6 million customers at risk.

According to the data protection watchdog, the company “failed to implement sufficiently robust technical and security measures”.

Commenting on the fine, information commissioner John Edwards said LastPass failed customers and “fell short” on expectations that the company would employ robust measures to protect personal data.

“Password managers are a safe and effective tool for businesses and the public to manage their numerous login details and we continue to encourage their use,” he said.

“However, as is clear from this incident, businesses offering these services should ensure that system access and use is restricted to ensure risks of attack are significantly reduced," Edwards added.

“LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure. However, the company fell short of this expectation, resulting in the proportionate fine being announced today."

The LastPass breach explained

The LastPass breach unfolded in two separate phases. In the first incident, a hacker compromised an employee’s corporate laptop and gained access to the company’s development environment.

While no personal information was taken, encrypted company credentials were - which, if decrypted, would allow access to the company’s backup database.

LastPass took steps to mitigate the hacker’s activity, but thought the encryption keys were safe, as they were stored in the account vaults of four senior employees, outside the area accessed by the hacker.

However, the next day, the hacker targeted one of these employees, gaining access to their personal device via a known vulnerability in a third-party streaming service.

The hacker then installed a keylogger, capturing the employee’s master password and bypassing multi-factor authentication (MFA) using a trusted device cookie. This gave access to the employee’s personal and business LastPass vaults, which were linked using a single master password.

Thereafter, the threat actor gained access to the employee’s business vault, which contained the Amazon Web Service (AWS) access key and decryption key. When combined with information taken the day before, this allowed the hacker to extract the contents of the backup database containing the customers' personal data.

LastPass’ ‘zero knowledge’ system prevented disaster

As the ICO noted in its post-mortem of the incident, the threat actor responsible for the breach wasn't able to decrypt encrypted passwords and other credentials.

This was thanks to LastPass’ use of a ‘zero knowledge’ encryption system, whereby the master password required to access a password vault is stored locally on a customer’s own device and never shared with LastPass.

While this represented a reprieve for the company and users, the impact of the breach was felt by customers as late as December 2024.

A probe by crypto investigator ZachXBT found hackers stole $12.38 million in cryptocurrency from LastPass users on 16 and 17 December 2024.

Chris Linnell, associate director of data privacy at Bridewell, said the ICO fine represents a “big moment” for the industry and highlights the need for more robust processes at password managers.

These platforms hold the keys to the castle for enterprises and consumers alike, and security practices at providers should reflect that.

"It’s not the largest penalty we’ve seen under John Edwards, but it definitely plays into public expectations - people trust password managers to keep them safe, so when they fall short, it makes headlines," he said.

"For service providers, this is a reminder that security isn’t just about the product itself. You need strong information security and privacy frameworks in place, and you can’t ignore the less obvious risks - backups, secondary databases, and other systems that attackers often target.”

MORE FROM ITPRO

• Most passwords take a matter of minutes to crack
• Passwords are a problem: why device-bound passkeys can be the future of secure
• How to create a secure password policy

The Information Commissioner's Office (ICO) has slapped a fine of £2.31 million on genetic testing company 23andMe for failing to protect customer data after a cyber attack.

The credential stuffing attack, which took place between April and September 2023, saw the exposure of the personal information of 155,592 UK residents.

The data exposed included names, birth years, location, profile images, race, ethnicity, family trees, and health reports.

At the time, the company was roundly criticized for appearing to blame users themselves for the breach. It wrote to customers saying they'd "failed to update their passwords following past security incidents unrelated to 23andMe", and had "negligently recycled" login credentials from other accounts that were already exposed.

The ICO, though, takes a different view.

"This was a profoundly damaging breach that exposed sensitive personal information, family histories, and even health conditions of thousands of people in the UK. As one of those impacted told us: once this information is out there, it cannot be changed or reissued like a password or credit card number," said information commissioner John Edwards.

"23andMe failed to take basic steps to protect this information. Their security systems were inadequate, the warning signs were there, and the company was slow to respond. This left people's most sensitive data vulnerable to exploitation and harm."

Specifically, the ICO found that 23andMe had failed to implement appropriate authentication and verification measures when customers logged in, including mandatory multi-factor authentication (MFA) and strong passwords.

It also failed to put appropriate security measures in place to deal with access to and the downloading of raw genetic data.

Nor did it have the right measures in place to monitor for, detect, and appropriately respond to cyber threats to its customers' personal information.

"Strong data protection must be a priority for organizations, especially those that are holding sensitive personal information," said Philippe Dufresne, privacy commissioner of Canada, who collaborated with the ICO on the investigation.

"With data breaches growing in severity and complexity, and ransomware and malware attacks rising sharply, any organization that is not taking steps to prioritize data protection and address these threats is increasingly vulnerable."

As well as failing to protect customer data, 23andMe handled the attack badly, the authorities concluded. The hackers kicked off their credential stuffing attack in April 2023, ramping up efforts in May and attempting to initiate profile transfers in July. This didn't happen invisibly, with 23andMe's platform stopping working, leaving the company's users unable to access it.

However, said the ICO, "Despite 23andMe investigating this incident at the time, it failed to detect that this was part of a larger ongoing data breach."

It didn't start a full investigation until October 2023, when a 23andMe employee discovered that the stolen data had been advertised for sale on Reddit. Only then did 23andMe confirm that a breach had occurred.

In August, indeed, it even dismissed a claim of data theft affecting over 10 million users as a hoax.

23andMe has since filed for Chapter 11 bankruptcy in the US, with a sale hearing set for today. The ICO said it was monitoring the situation closely, pointing out that the protections and restrictions of the UK GDPR continue to apply.

The UK's Information Commissioner’s Office (ICO) has issued guidance on the use of AI recruitment tools following a wide-ranging review.

With AI increasingly being used to source potential candidates, summarize CVs, and score applicants, the ICO said it's become concerned that their use can cause problems for job applicants in terms of their privacy and information rights.

Some AI tools were not processing personal information fairly, for example, by allowing recruiters to filter out candidates with certain protected characteristics.

Others were even inferring characteristics such as gender and ethnicity from a candidate’s name, rather than asking for the information.

Meanwhile, some AI recruitment tools collected far more personal information than necessary and retained it indefinitely to build large databases of potential candidates without their knowledge.

The ICO has now made nearly 300 recommendations, such as ensuring personal information is processed fairly and kept to a minimum, and clearly explaining to candidates how their information will be used by the AI tool.

"AI can bring real benefits to the hiring process, but it also introduces new risks that may cause harm to jobseekers if it is not used lawfully and fairly. Our intervention has led to positive changes by the providers of these AI tools to ensure they are respecting people’s information rights," said Ian Hulme, ICO director of assurance.

"Our report signals our expectations for the use of AI in recruitment, and we're calling on other developers and providers to also action our recommendations as a priority. That’s so they can innovate responsibly while building trust in their tools from both recruiters and jobseekers."

Some of the most important measures, said the ICO, include completing a Data Protection Impact Assessment (DPIA), to understand, address and mitigate any potential privacy risks or harms.

Organizations must also identify an appropriate lawful basis for collecting data, such as consent or legitimate interests. Special category data, such as racial, ethnic origin or health data involves extra conditions.

Recruiters must identify who is the controller and processor of personal information and set explicit and comprehensive written instructions for providers to follow, and check that the provider has mitigated bias.

Candidates should be told how an AI tool will process their personal information, and recruiters must ensure that the tool collects only the minimum amount of personal information required to achieve its purpose, and that it won't be used in any other ways.

The developers concerned have all accepted or partially accepted all the ICO's recommendations.

“We are actively working to implement the specific actions agreed with the ICO in our audit plan," said one. "For example, we are making sure to provide the relevant information regarding the use of AI in our privacy policies and evaluating the steps taken to minimize bias when training and testing our AI tools."

The UK Information Commissioner’s Office (ICO) is calling on organizations to do more to support victims after a data breach.

According to ICO figures, nearly 30 million people in the UK have experienced a data breach. In total, 55% of UK adults reported having had their data lost or stolen, with 30% of them experiencing emotional distress as a result.

However, a quarter said they received no support from the organizations responsible and 32% found out about the breach via the media, rather than from the organization itself.

Information Commissioner John Edwards said the figures highlight that many organizations “fail to fully appreciate the harm they cause then they mishandle personal data”.

Edwards urged enterprises to act with “empathy and action” when dealing with data breach victims.

"Today, I want to issue a stark warning to organizations across the country: you must do better," he said.

"When a data breach occurs, it’s not just an admin error – it is a failure to protect someone. In many cases if that someone is in a vulnerable situation, they are already facing innumerable personal challenges, or they may be at risk of harm."

Qualitative research conducted by the ICO, meanwhile, found people have had to move homes, felt forced out of their jobs, and faced discrimination as a result of data breaches. Analysis from the data protection watchdog found the real impact on their life was insufficiently recognized by the organization responsible.

ICO issues updated guidance for organizations

New guidance issued by the ICO calls on organizations to assess the risks to the individuals involved, and carry out its reporting and notification duties promptly.

They should acknowledge what has happened to people affected by a breach, be human and accessible in their response, and commit to making sure it doesn’t happen again.

Similarly, organizations should share ICO guidance with people affected by a breach, and make sure that staff have access to the ICO toolkit of resources.

Another key focus should be implementing changes to corporate culture and ensuring that empathy is at the heart of their response, the ICO said.

"To many organizations, a data breach might seem like a temporary setback - something that can be patched up with technical fixes and compliance reviews," said Edwards.

"But from the perspective of individuals - especially those in vulnerable situations - a breach can have a far-reaching ripple effect that disrupts their lives in ways that some may not fully appreciate."

LinkedIn has suspended the use of UK user data for AI training following a fierce backlash from digital rights campaigners, users, and regulators.

The social network recently changed its privacy policy to use an ‘opt-out’ setting for the use of customer data to train its internal AI models.

In an update to its policies, the Microsoft-owned firm said the use of user data would help improve generative AI features. The change prompted a backlash among users on social media, with digital rights campaigners urging users to opt-out of the scheme.

"Like other features on LinkedIn, when you engage with generative AI powered features we process your interactions with the feature, which may include personal data (e.g., your inputs and resulting outputs, your usage information, your language preference, and any feedback you provide)," LinkedIn said in its FAQs.

The UK’s Information Commissioner’s Office (ICO) expressed concerns over the move, with the regulator noting that the opt-out approach wasn’t sufficient to protect user privacy.

Similarly, digital rights group Open Rights Group complained the opt-out model “proves once again to be wholly inadequate to protect our rights”.

“The public cannot be expected to monitor and chase every single online company that decides to use our data to train AI," said legal and policy officer Mariano delli Santi.

"Opt-in consent isn't only legally mandated, but a common-sense requirement."

LinkedIn U-turn welcomed by privacy watchdog

LinkedIn has since backed down, however, and will no longer apply the policy in the UK, along with the EU, the European Economic Area, and Switzerland.

In a statement, Blake Lawit, SVP and general counsel at LinkedIn, said the company has changed its user agreement to include more details on its content recommendation and content moderation practices, along with new provisions relating to generative AI.

The privacy policy, meanwhile, now has more information on how user data is harnessed to develop products and services. This includes details on how user data is used to train AI models.

"We are not enabling training for generative AI on member data from the European Economic Area, Switzerland, and the United Kingdom, and will not provide the setting to members in those regions until further notice,” Lawit added.

The ICO has welcomed the decision, noting in a statement that LinkedIn has taken on board key concerns raised about its approach to AI training.

"We are pleased that LinkedIn has reflected on the concerns we raised about its approach to training generative AI models with information relating to its UK users,” said Stephen Almond, ICO executive director, regulatory risk.

"In order to get the most out of generative AI and the opportunities it brings, it is crucial that the public can trust that their privacy rights will be respected from the outset."

The use of user data for training AIs has become a controversial one. Earlier this year, Meta halted the use of the data of UK Facebook and Instagram data for this after the ICO raised concerns.

The company has since started using UK data once again under an altered consent model, claiming it satisfied the ICO's demands.

The ICO said it will continue to monitor the situation with Meta - and the same, Almond said, will be true of LinkedIn.

“We will continue to monitor major developers of generative AI, including Microsoft and LinkedIn, to review the safeguards they have put in place and ensure the information rights of UK users are protected," he said.

The UK's Information Commissioner’s Office (ICO) and National Crime Agency (NCA) are planning to improve the support they give to organizations experiencing cyber attacks.

In a Memorandum of Understanding (MoU), the two agencies set out plans to make sure that victims are signposted to relevant bodies, such as the National Cyber Security Centre (NCSC), and are empowered to report cyber crime at the earliest opportunity.

“Unfortunately, we’ve seen cyber crime costing UK firms billions over the past years. That’s why it’s crucial that relevant bodies work together to boost the UK’s cyber resilience," said Stephen Bonner, ICO deputy commissioner - regulatory supervision.

"This new memorandum of understanding builds on our existing relationship with the NCA and will help improve cybersecurity standards across the board, while respecting each other’s remits."

The MoU commits the ICO and NCA to encourage organizations to engage with the NCA on cybersecurity matters, including the response to cyber crime, promising that the NCA will never pass on information shared in confidence without having first received the organization's consent. 

The ICO will also share information about cyber incidents with the NCA on an anonymized, systemic, and aggregated basis - and on an organization-specific basis where appropriate - to help protect the public from serious and organized crime.

Where the ICO and NCA are both engaged in a cyber incident, they'll work together to minimize disruption to the organization’s efforts to contain and mitigate harm.

Similarly, the two agencies will also work together to promote learning, provide consistent guidance, and improve standards on cyber-related matters while continuing to work closely with the National Cyber Security Centre (NCSC).

The NCA noted that organizations have a legal responsibility – under both data protection law and the Network and Information Systems Regulations – to report incidents that meet a certain threshold.

There’s a huge amount of assistance on offer, the crime agency added, including tailored technical advice, the creation of secure communication channels, insight into an attacker’s possible motivations, and strategic advice on how to engage with the rest of government, regulators, and the media.

"The NCA leads a whole-system response to cyber crime, disrupting cyber criminals and putting them before the courts wherever possible," said NCA deputy director Paul Foster, head of the National Cyber Crime Unit.

"Organizations who are vulnerable to imminent attack or find themselves a victim also need support and guidance, and we work closely with our partners to provide this."

"We are pleased to be making this commitment with the Information Commissioner’s Office; this agreement signifies our common goal of establishing and maintaining a secure and resilient cyber ecosystem for all."

The UK Information Commissioner’s Office (ICO) has reprimanded the Electoral Commission for basic security failings that exposed personal data belonging to 40 million voters.

Two years ago, hackers successfully accessed the Electoral Commission’s Microsoft Exchange Server by impersonating a user account and exploiting known software vulnerabilities in the system.

For more than a year, they had access to the personal information held on the Electoral Register, including names and home addresses - and the servers were accessed on several occasions without the Electoral Commission’s knowledge.

The attack was widely attributed to Chinese state-sponsored attackers.

Following an investigation into the matter, the ICO found the Electoral Commission didn't have appropriate security measures in place to protect the personal information it was holding.

In particular, the watchdog said it failed to keep servers up to date with the latest security updates. The security patches for the vulnerabilities exploited in the cyber attack were released in April and May 2021, months before the attack.

Meanwhile, the Electoral Commission also had inadequate password policies in place, according to the ICO, with many accounts still using passwords identical or similar to the ones originally allocated by the service desk.

"If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened. By not installing the latest security updates promptly, its systems were left exposed and vulnerable to hackers," said Stephen Bonner, deputy commissioner at the ICO.

"I know the headline figures of 40 million people affected caused considerable public alarm when news of this breach emerged last year. I want to reassure the public that while an unacceptably high number of people were impacted, we have no reason to believe any personal data was misused and we have found no evidence that any direct harm has been caused by this breach."

The Electoral Commission has since taken steps to improve its security, including implementing a plan to modernize its infrastructure, as well as password policy controls and multi-factor authentication for all users.

But BCS fellow Dan Card said the breach shouldn't come as a surprise.

"This scenario isn't even an edge case — it reflects the state of a significant number of organizations, including some critical national infrastructure," he said.

"Reports indicate that the threat actors exploited ProxyShell, a vulnerability that was extensively discussed and addressed within the cybersecurity community. The organization's failure to act promptly is a glaring oversight, compounding the severity of the other findings."

New data shows the Information Commissioner’s Office (ICO) received more than 15,000 complaints about mishandled Data Subject Access Requests (DSARs) in 2023 – and many are being made by disgruntled ex-employees.

Launching new guidelines on how to respond to DSARs, the ICO recently revealed that the number of complaints it received increased by 13.5% in 2023 compared with the previous year, hitting a total of 15,335.

They amounted to 45% of all complaints received by the ICO.

The ICO is keen to make sure that organizations understand their obligations and respond appropriately.

"What we’re seeing now is that many employers are misunderstanding the nature of subject access requests, or underestimating the importance of responding to requests," said Elanor McCombe, ICO policy group manager.

"For example, employers may be unaware that requests can be submitted informally, such as over social media, or do not have to contain the words ‘subject access request’ in order to qualify as a legally binding request. Similarly, employers may not realize that there is a strict time frame for responding to requests, and this must be kept to."

It's misunderstandings like this that lead to many complaints. However, according to Deborah Margolis, senior associate at GQ|Littler, many DSARs are from disgruntled former employees who use the data as a 'fishing expedition' to obtain copies of documents pre-disclosure, or as a strategy to encourage the employer to reach a settlement with them.

"Responding to DSARs can take up a significant amount of business resources in terms of both cost and management time. Bearing in how much data we create and process about employees on a daily basis, the time spent trawling through documents is overwhelming for many businesses," she said.

"DSARs were intended to help individuals to determine if their personal data was being mishandled but some individuals have now weaponized DSARs with the intention of causing disruption for employers and forcing them into reaching favorable settlements."

Earlier this year, the ICO reprimanded Plymouth City Council and Norfolk County Council for failing to respond to information access requests, while in September 2022 it took action against seven organizations that failed to respond to DSARs.

However, following Brexit, the government has proposed amendments to UK data protection law that would shift it away from GDPR, with a new Data Protection and Digital Information Bill expected to pass this year.

This, the law firm said, is expected to make compliance with DSARs less burdensome for businesses. In particular, it would be easier for organizations to reject or charge a fee for ‘vexatious’ DSARs.

"This would be a welcome change for employers, many of whom feel that the existing rules allows too many opportunities for abuse," Margolis said.

The UK Information Commissioner’s Office (ICO) has reprimanded a Coventry school for data breaches after its IT system was hacked several times.

Finham Park Multi Academy Trust received a slap on the wrist for failing to ensure the confidentiality and integrity of systems and services, or to implement the right technical and organizational measures to ensure appropriate security.

The data watchdog said an unauthorized third-party used compromised credentials to access and encrypt Finham Park’s system, which resulted in the exposure of data belonging to more than 1,800 people.

The failure marked a repeat office, the ICO added.

"Finham Park reported three similar incidents to the Commissioner and each time the Commissioner provided guidance to Finham Park, which set out the importance of implementing appropriate password policies and account management procedures," the ICO said in a statement.

"Finham Park failed to follow this guidance and failed to implement appropriate technical and organizational measures to secure its systems."

In particular, the school had an inadequate account lockout policy, with reversible password encryption enabled, and didn't have multi-factor authentication (MFA) in place. The academy also failed to make sure employees had sufficient knowledge and understanding around the re-use of passwords.

"The NCSC emphasizes that passwords should not be re-used across accounts," the watchdog said. "Had Finham Park educated its employees on password management more effectively, it is possible that this incident could have been avoided."

It appears that the school has finally got the message.

"The Commissioner has also considered and welcomes the remedial steps taken by Finham Park in light of this incident," the ICO added in its statement.

"In particular, Finham Park restored its systems from backups, implemented MFA across the trust, and signed off a digital transformation project plan, which included credential monitoring."

The reprimand reinforces the need for educational institutions to have robust IT security policies and procedures in place, given the sensitivity and large amount of data they hold, according to solicitor Laura Rae of Forbes Solicitors.

"By having clear password policies and lockout procedures, schools should significantly reduce the likelihood of cyber-security incidents occurring, but then also have a clear process for managing and mitigating the effects of these incidents when they occur," she said.

"Alongside this, staff should be made aware of the importance of password security and regularly updating passwords, as part of regular data protection training."

While reprimands don't carry any financial penalty, they work to 'name and shame' organizations, bringing reputational damage and possibly forming evidence in claims for compensation for a data breach.

The ICO issues reprimands in cases where it has found a breach of the UK GDPR, but believes that the breach isn't serious enough to attract a fine. These are often given to public sector organizations, rather than issuing a fine which would then have to be paid for out of public funds.

The legality of generative AI training methods is set to be examined by the Information Commissioner’s Office (ICO) amid concerns over the use of personal data. 

AI training methods have been a key talking point in recent months due to the manner in which large language models (LLMs) are built. LLMs such as ChatGPT are typically built using vast amounts of data collected through web scraping.

However, these practices have raised concerns both about data privacy and the legal repercussions for developers that fall foul of copyright laws.

The ICO said conversations with developers in the AI space have highlighted several areas where organizations seek greater clarity around how data protection laws apply to the development and use of generative AI.

This includes questions over the appropriate lawful basis for training generative AI models, and how the purpose limitation principle plays out in the context of generative AI development and deployment.

There are also lingering questions about complying with the accuracy principle, as well as the expectations in terms of complying with data subject rights.

Over the coming months, the ICO said it plans to release guidance on its position on the matter, outlining how specific requirements of UK GDPR and the Data Protection Act (2018) could impact generative AI training methods.

"The impact of generative AI can be transformative for society if it’s developed and deployed responsibly," said Stephen Almond, the ICO's executive director for regulatory risk.

"This call for views will help the ICO provide industry with certainty regarding its obligations and safeguard people’s information rights and freedoms."

Generative AI training and ‘legitimate interest’

Under the UK GDPR, the purpose of data processing must be legitimate and necessary for that purpose, and the individual’s interests must not override the interest being pursued.

The ICO said its current thinking is that legitimate interests can be a valid lawful basis for training generative AI models on web scraped data, as long as the model developer can ensure they pass this three-part test.

The developer’s interest could be simply the business interest in developing a model and deploying it for commercial gain, or wider societal interests - as long as the developer can evidence the model’s specific purpose and use.

As for necessity, the ICO recognizes that, currently, most generative AI training is only possible using data obtained through large-scale scraping.

With the 'balancing' test, the data watchdog noted that things can be complicated depending on whether generative AI models are deployed by the initial developer, by a third-party through an API, or simply provided to third parties.

The ICO said it will engage with stakeholders from across the technology industry as part of the investigation, including developers and users of generative AI, legal advisors and consultants working in the space, civil society groups, and public bodies with an interest in generative AI.

The first consultation is open until 1 March, with future consultations planned during the first half of this year to examine issues such as the accuracy of generative AI outputs.

Recipe kit delivery service HelloFresh has been fined £140,000 by the Information Commissioner's Office (ICO) for pestering customers with tens of millions of spam messages.

According to the data protection regulator, the company sent 79 million spam emails and a million texts in just seven months. The messages were sent on the basis of an opt-in statement which the ICO said didn't make any reference to the sending of marketing via text.

Although there was a reference to marketing via email, this came as part of an age confirmation statement which the regulator said was likely to incentivize customers to agree.

The message read: "Yes, I’d like to receive sample gifts (including alcohol) and other offers, competitions and news via email. By ticking this box I confirm I am over 18 years old".

Customers also weren't properly warned that their data would continue to be used for marketing purposes for up to 24 months after they had cancelled their subscriptions.

"This marked a clear breach of trust of the public by HelloFresh," said Andy Curry, head of investigations at the ICO.

"Customers weren’t told exactly what they’d be opting into, nor was it clear how to opt out. From there, they were hit with a barrage of marketing texts they didn't want or expect, and in some cases, even when they told HelloFresh to stop, the deluge continued."

HelloFresh complaints began in 2022

The ICO investigation began in March 2022 following complaints made to both the ICO and to the 7726 spam message reporting service. In some cases, the company carried on contacting people even after they had asked for this to stop.

"I had previously bought from this company and ensured that I did not consent to marketing material. I was not happy with their service so cancelled my subscription," one complainant said. 

“Recently (last 1-2 months) I have started regularly receiving unsolicited advertising emails from the company, and now they are sending unsolicited text messages."

The emails and texts were sent in contravention of Regulation 22 of the Privacy and Electronic Communications Regulations (PECR), the investigation found.

The opt-out consent statement wasn't, as it should have been, 'specific' and 'informed', as it didn't mention SMS, was unclear and bundled with other aspects, and didn't highlight the fact that customers would carry on receiving messages after they cancelled their HelloFresh subscription.

"In issuing this fine, we are showing that we will take clear and decisive action where we find the law has not been followed," Curry said. "We will always protect the right of customers to choose how their data is used."

The ICO said it's issued more than £2.44 million in fines against companies responsible for nuisance calls, texts and emails since April 2023, with another £2.8 million in 2021/22.

In December, it took action against Daniel George Bentley and his firm Taipan Trading for sending 2.5 million unsolicited direct marketing text messages, issuing an enforcement notice.

The Information Commissioner’s Office (ICO) fined businesses more than £14.3 million for misusing data last year, according to an analysis by cyber security and data protection consultancy CSS Assure.

ICO fines were imposed on 18 businesses, with the ICO also reprimanding 36 companies, issuing enforcement notices against a further 19, and prosecuting four businesses for failing to meet their obligations on information rights.

The year's largest fine, £12.7 million, was imposed on social media platform TikTok for breaching data protection law around the use of children’s personal data, with the ICO estimating that up to 1.4 million under-13s in the UK were able to use the video sharing app in 2020.

Charlotte Riley, director of information security at CSS Assure, said the ICO fines underline the serious repercussions faced by businesses for failing to adhere to robust data protection standards.

"The fines imposed by the ICO in 2023 highlight the serious consequences of misusing data," she said. "Mishandling personal information not only violates data protection laws but also erodes trust among consumers."

"TikTok’s £12.7 million penalty underscores the importance of lawful use of personal data and implementing appropriate safeguards, especially when it involves children," Riley added. "TikTok is a large, well-known brand, and its fine was substantial due to the sheer amount of data involved."

ICO fines issued for marketing violations

There were a combined £310,000 in ICO fines for three marketing firms found to be making a total of 483,051 unsolicited marketing calls to businesses and sending 107 million spam emails to jobseekers, analysis from CSS Assure revealed. 

Similarly, two energy firms were fined a combined £250,000 for making marketing calls to people on the UK’s ‘do not call’ register.

A business support consultancy was also fined £30,000 for sending 558,354 direct marketing SMS messages without valid consent while an appliance service and repair company was fined £200,000 for making more than 1.7 million unsolicited direct marketing calls.

During the second half of the year, 10 companies were collectively fined more than £800,000 for sending a total of 4,698,841 unwanted text messages, 39,906,342 emails, and making 1,937,028 nuisance phone calls.

Riley said the sharpened focus on cracking down on nuisance calls and spam marketing tactics serves a clear message to organizations across the country for the year ahead.

"The fines imposed on businesses for unsolicited calls and text messages, and spam emails, as well as firms for disregarding the 'do not call' register, demonstrate the significant impact of invasive marketing practices," she said.

"These penalties send a clear message that companies must respect individuals’ privacy preferences and refrain from bombarding them with unwanted communications."

The ICO had a “busy year” in 2023

The ICO described 2023 as 'a busy year', noting that it handled 116,000 business service calls and 70,000 public advice calls. 

The watchdog also received more than 33,000 data protection complaints and over 7,000 FOI complaints, with 288 investigations opened and 346 closed.

Its priorities for this year, it said, are to support the new Data Protection and Digital Information (DPDI) bill as it makes its way through Parliament, and to set out clear expectations that privacy and artificial intelligence (AI) go hand in hand.

Speaking at TechUK’s Digital Ethics Summit last month, information commissioner John Edwards said the regulator will be taking a measured approach to AI in 2024, but warned businesses that data privacy standards must be a key consideration.

"I want to make it clear from the very start that we are not against organizations using AI," he said.

"We just want to ensure that they are using AI in sensible, privacy-respectful ways, ensuring that people’s personal information and privacy rights remain protected throughout."

Microsoft’s Excel is cost-effective and easy to use, which are major draws for public sector organizations and small businesses. However, Excel has been under the spotlight over the last few months after the data breaches at the Police Service of Northern Ireland (PSNI) saw personal information inadvertently exposed in spreadsheets shared as part of a Freedom of Information (FOI) request.

The fear of another high-profile incident was so great that in September, UK regulator the Information Commissioner’s Office (ICO) issued a warning against using Excel spreadsheets when responding to FOI requests.

There’s no doubt Excel is a flexible tool for data management and analysis, but its openness can lead to security concerns and leave it vulnerable to breaches of regulation such as the General Data Protection Regulation (GDPR).

Many public sector organizations are currently using Excel to manage and analyze their data. What are the risks and benefits of each approach?

How easy is it to use Excel for data analysis?

Excel is well-known and has been around for a long time so ease of use is one of its biggest benefits, says Katie McCullough, CISO at Panzura. “Virtually everyone knows how to navigate an Excel spreadsheet and that's a huge plus when you're trying to implement a system across an organization with varying levels of technical skill.”

Excel enables a variety of data manipulations and calculations, which is why it's often leaned on for data analytics, says McCullough. It’s also specifically aimed at business users and the best Excel courses can teach employees how to use the software to dramatically improve their efficiency at work. However, she says, Excel’s accessibility can be a “double-edged sword”. 

When using the tool for data management, Excel's openness can lead to significant security concerns, says McCullough. “When you're handling sensitive public sector data, the unstructured nature of Excel can make it difficult to maintain control over who has access to the information and how it's being altered.”

Auditability can also be a challenge. “If you can't track the provenance of the data or the changes made to it, you're going to run into problems when you need to substantiate your findings or decisions, says McCullough. “While Excel is a powerful tool for analysis, its use for managing data – especially sensitive information – requires careful consideration of these inherent risks.”

While sensitive data can be easily stored in Excel spreadsheets, this can be hard to do in compliance with data protection policies and procedures. Indeed, Excel was never designed as a data management tool: It is “simply too easy” for users to expose sensitive information to unintended audiences, says Nelson Petracek, CTO at business planning company Board International. 

“Data is not managed in a way that is easily controlled or secured, and users can hide information via hidden tabs and columns, embedded data elements, formatting – or even by moving it to an area outside of the normal viewpoint,” Petracek says.

“This makes it difficult to determine if sensitive data exists in a workbook or Excel application.”

Security in Excel is typically set at a workbook or worksheet level, which is “simply not a fine enough level of granularity to ensure proper data security and privacy”, adds Petracek. “It is also easy to send files over insecure channels, lose track of versions, or for files to be sent or carried outside of an organization’s firewall.”

The risk of Excel macros

Another security issue that has already been the subject of a warning by the UK’s National Cyber Security Centre (NCSC) is macros. These are action scripts used to automate tasks in Excel and are often helpful for obtaining insights within the software. But they can also negatively impact security as Blake Jeffrey, general manager, security and identity at Intelliworx, tells ITPro. “Macros are often created for legitimate reasons, but they can also be used by attackers to gain access to or harm a system, or to bypass other security controls.”

At the same time, building a proper data governance strategy and meeting compliance checks can be a challenge with Excel, says Jeffrey. “Excel lacks the specific features needed to manage complex tasks related to GDPR for example, such as data mapping, consent management, and data subject access request handling.”

The issue is not unique to UK organizations, as the US is impacted by security and data protection concerns too. “In the US and UK, public sector organizations often deal with sensitive data and Excel may not provide the level of security required,” says Jasmine Harrison, account manager at Data Protection People. 

Regulations such as the Health Insurance Portability and Accountability Act (HIPAA) “emphasize stringent data protection measures”, she points out.

Beyond regulation, Microsoft’s own guidance recommends using Excel for data analysis and its software Access for data management – but this is frequently ignored. Experts say Access is a more structured and secure database management system. However, Excel's familiarity and popularity can make it the go-to choice, even when it's not the best fit for data management, says Harrison. 

Excel is also readily available as part of the Microsoft Office suite that most organizations already have, McCullough points out. This means that despite the best intentions of Microsoft's guidance, the “convenience and familiarity of Excel” often leads to its use in scenarios better suited for a dedicated database management system such as Access. But this doesn’t make Excel the best option for database costs, performance, and value in the long run.

Alternatives to Excel for data management

It’s clear Excel is not fit for purpose when it comes to storing sensitive data, but what’s the alternative? While there are other options available, many of the pitfalls are the same, says McCullough. “It’s important to weigh the options against the risks, especially given the recent ICO guidance. The ICO emphasizes the importance of data integrity and security, which are critical for any organization, regardless of size.”

For smaller organizations, the key is to find solutions that maintain the simplicity and user-friendliness of Excel while offering enhanced security and data management features, says McCullough. 

Google Sheets is one alternative to Excel. “It's a familiar spreadsheet environment with the added advantage of automatic Google cloud storage and version control, which is not a perfect solution, but can help with data integrity,” McCullough says. It also allows for easier control of user access, which she says “aligns somewhat” with the ICO's emphasis on data protection.

While other options are available, the likes of OneTrust might be too expensive for smaller organizations, says Harrison. With this in mind, she recommends alternatives such as DataWise, which “may be more budget-friendly in comparison”.

However, it's not just about picking a different spreadsheet tool: Organizations must understand the need for structured data management practices, says McCullough. “Even with alternatives such as Google Sheets, the principles of good data management are the same – knowing where your data is, who has access to it, and ensuring it's backed up and recoverable in the event of an incident.”

To protect your company from the next big data breach, it’s important to assess the tools you use for data management. Ease of use or employee familiarity should never come second to proper data controls.

The UK’s Information Commissioner’s Office (ICO) has warned it may impose harsh penalties and publicly name websites that fail to make changes to their cookie consent policies. 

The ICO said that some are failing to give users a clear choice about whether they want to opt-in to personalized advertising, and make it just as easy to 'reject all' as to 'accept all'.

While websites can still display adverts when users reject all tracking, they must not tailor these ads to the person browsing.

Stephen Almond, ICO executive director for regulatory risk issued a warning to websites that consistently fail on cookie consent, adding that the regulator will clamp down on those who don’t comply.

"We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent,” he said.

"Gambling addicts may be targeted with betting offers based on their browsing record, women may be targeted with distressing baby adverts shortly after miscarriage and someone exploring their sexuality may be presented with ads that disclose their sexual orientation."

Without naming names, the ICO said it has written to companies running some of the UK’s most-visited websites to voice concerns about their cookie consent policies.

The regulator has given them 30 days to ensure their websites comply with current legislation on the matter.

"Many of the biggest websites have got this right," said Almond. "We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences."

The ICO said it will provide an update on progress in January. For organizations that are still to comply, it will provide the public with details.  

Cookie consent crackdown

The move follows a warning earlier this summer in which the ICO began assessing cookie consent banners. The regulator said at the time it would take action against those who don’t comply.

While the legal requirement for cookie banners derives from the GDPR, the UK's departure from the EU hasn't yet led to any change in the rules.

Companies are required to gain explicit consent from users before using marketing cookies or trackers, and the buttons used for this must make it at least as easy to deny as to consent.

In the EU, rules are similar, although there's no clear rule that 'reject all' must appear at the same time, and be as easy to choose as 'accept all'.

Different countries within the union have slightly different policies. Austria and Spain, for example, require a 'reject all' button in the first layer of the consent process while Germany does not.

Earlier this month, the European Data Protection Board (EDPB) published new guidelines on the use of cookies, clarifying which tracking techniques are covered.

"These guidelines discuss solutions, such as tracking links and pixels, local processing, and unique identifiers, to ensure that the consent obligations set out by the article are not circumvented," said EDPB chair Anu Talus.

The Information Commissioner’s Office (ICO) in the UK has abandoned its probe into the 2020 data breach at budget airline EasyJet due to “limited resources”. 

According to the watchdog, the continuation of an investigation into the data breach was not in its interests and failed to represent the best use of its resources. 

The EasyJet hack remains one of the largest data breaches in UK history, with data belonging to around nine million customers exposed. 

Information including names, email addresses, travel details, and credit card details was accessed in the breach.

Customers were warned at the time they could face heightened security threats, such as phishing, as a result of the breach. 

Confirming the decision to drop the investigation, a spokesperson for the watchdog said it still places a strong focus on enforcement of data protection rules and that “all data breaches reported to us are important”. 

“The ICO regulates the whole UK economy and so we have to continuously review and make difficult choices about which issues we take forward,” the spokesperson said. 

“It is our duty to ensure we use our powers to have the maximum possible positive impact for the public and provide regulatory certainty to organizations. 

“Having carefully considered this particular case, the Commissioner decided that pursuing enforcement action would not be the best use of our limited resources at this time.”

The ICO said it’s currently in the process of transforming how it prioritizes and delivers activity to ensure “timely and transparent results”. 

The move is part of a concerted effort at the watchdog to prepare for the forthcoming Data Protection and Digital Information Bill, the spokesperson added. 

ICO decision could create wrong message

The decision to drop the probe has been met with criticism from security industry practitioners amid claims that it could send the wrong message to organizations in the future. 

Mike Newman, CEO of My1Login, said the decision is concerning given that British Airways was handed a £20 million fine for a “much smaller data breach”. 

“The industry was expecting the ICO to come back on EasyJet with its full force, but evidently this is not the case,” he said. 

“Over nine million people had their personal data compromised, which put them at serious risk of phishing, financial fraud, and identity theft. It is therefore deeply concerning that the ICO has dropped its investigation into the attack, and could send out a very wrong message to other organizations.”

Barrier Networks CISO, Jordan Schroeder, echoed Newman’s comments on messaging. However, he insisted the ICO still appears firmly committed to enforcement and ensuring robust data protection standards across the UK. 

“This latest update could give off mixed messages and it will undoubtedly receive a lot of scrutiny, but it shouldn’t be seen as an indication that the ICO is ‘easing up’ or that data breaches will be tolerated,” he said. 

“Organizations have a duty to care for the data they hold and process, and they must take the protection of that data very seriously. These protections shouldn’t only be motivated by compliance or the risk of regulatory fines, but mainly because of their duty of care to customers, employees, and partners.”

Nearly one-third of security decision makers in the UK claim they have been reported to the Information Commissioner’s Office (ICO) over a data breach by an individual outside their organization. 

Analysis from Manchester-based encryption firm, Apricorn, recorded a steep increase in the number of organizations reported to the ICO so far during 2023, with 32% reported by someone outside their firm. 

The increase marks a significant rise compared to previous years. In 2022, just 4% of breaches were reported to the watchdog by outsiders while in 2021 this stood at 10%. 

This, the firm said, suggests a growing public appetite to hold businesses to account over potential data security risks. 

“This could be a sign of increased awareness as people become more au fait with the signs of a data breach and the importance of reporting them, but it could also indicate a lack of internal awareness or due process,” the company said. 

Jon Fielding, managing director for EMEA at Apricorn said the trend raises additional questions over internal reporting practices in the event of a data breach or potential risks to consumers. 

“Not all breaches are reportable, but likely recordable. The fact these breaches have been reported from outside the organization may indicate that internal teams are not as aware as they should be of transgressions,” he said.

Research earlier this year found that nearly half of cyber security practitioners have been told to keep data breaches “under wraps” by senior management.  

The study from Bitdefender revealed that 42% had been told to keep a data breach confidential when they knew it should have been reported

US-based security practitioners were found to be the most likely to have kept a breach hidden, with 71% failing to inform senior management or customers. UK and European-based respondents were typically more likely to report data breaches and security incidents, however. 

The repercussions for failing to disclose a data breach can be costly for organizations and individuals on both sides of the Atlantic. EU-based firms are required to notify authorities “without undue delays” and within 72 hours upon discovery of a breach. 

Internal reporting still prioritized 

Apricorn’s report said that despite an increase in external reporting, internal data breach disclosures are still prioritized by security leaders. 

Nearly half (40%) of respondents said breaches or potential breaches were reported to the ICO by someone within their organization. 

The study suggested this highlights a continued awareness on the importance of data breach disclosures and “speedy remediation” when complying with regulations such as GDPR. 

The Information Commissioner's Office (ICO) has issued fresh guidance urging organizations to “consider workers’ rights” when introducing workplace monitoring tools. 

The advisory follows a report that found 70% of the public would find workplace monitoring practices “intrusive”. Almost one-in-five (19%) of respondents told the ICO they believe they have been monitored by an employer at some stage. 

The watchdog warned that excessive monitoring can “easily intrude into people’s private lives” and undermine privacy. 

“With the rise of remote working and developments in the technology available, many employers are looking to carry out checks on workers,” the ICO said in a statement.  

“The ICO has today published guidance to help employers fully comply with data protection law if they wish to monitor their workers.” 

The guidance is aimed at employers spanning both the public and private sector, and provides a “clear direction” on how organizations can implement monitoring techniques in a fair and lawful manner. 

Monitoring can include tracking calls, messages and keystrokes, webcam footage or audio recordings, or using “specialist monitoring software” to track worker activity, the ICO said. 

In addition, the advisory outlines best practice techniques for employers to help “build trust with their workers and respect their rights to privacy”. 

This includes informing staff about monitoring practices in a “way that is easy to understand” and ensuring workers are made fully aware of the “nature, extent, and reasons for monitoring”. 

The guidance also warns that organizations must have a “lawful basis” for processing workers data - such as consent or legal obligation. 

This includes the need for data protection impact assessments, which must be conducted for any monitoring practices that are “likely to result in a high risk” to workers’ rights.

Transparency in workplace monitoring

Emily Keaney, deputy commissioner for regulator policy at the ICO said that while data protection laws permit monitoring, organizations must prioritize privacy and the potential impact on workers.  

“As the data protection regulator, we want to remind organizations that business interests must never be prioritized over the privacy of their workers,” she said. 

“Transparency and fairness are key to building trust and it is crucial that organizations get this right from the start to create a positive environment where workers feel comfortable and respected."

Ella Bond, senior employment solicitor at Harper James, commended the publication of the guidance, and echoed Keaney’s comments on transparency.  

Organizations that fail to communicate with staff could risk harming relationships with their workforce and impact performance and morale.  

“It is crucial for employers to strike a balance between managing productivity and performance whilst respecting workers' privacy,” said Bond. “Workers have a legitimate expectation of privacy, even in the course of carrying out their duties.” 

“Monitoring should only be undertaken when it is necessary and proportionate, and it should be conducted in a way that respects workers' rights and freedoms. It is essential that employers communicate clearly with their staff about the nature, extent, and reasons for any monitoring activities. 

“Employers should have clear signage, procedures and policy documentation in place in order to help them to achieve this.”

Workplace monitoring practices have increased significantly since the onset of the COVID pandemic in 2020 and the subsequent shift to remote and hybrid working practices as employers sought to keep tabs on employee activities.  

A 2021 survey conducted by Prospect recorded a sharp rise in cases of webcam and video-based monitoring practices among employers.  

At the time, a majority (52%) of employees polled by the firm said they believe monitoring practices should be banned outright, while 28% said more robust regulation of the trend was required.  

The UK’s Information Commissioner’s Office (ICO) has issued an advisory to public bodies urging them to “stop using spreadsheets” when responding to requests made under the Freedom of Information Act 2000 (FoI). 

The advisory notice called for an “immediate end” to the use of Excel spreadsheets when responding to public requests for information, and outlined a series of recommendations for public authorities to follow. 

The ICO listed a number of core recommendations for responses. Public bodies have been advised against replying to FoI requests with spreadsheets containing “hundreds or thousands of rows”.

A recommendation to improve investment in data management systems that “support data integrity” was included in the guidance.

In addition, police services were advised to “convert spreadsheets and sensitive metadata into open reusable formats, such as comma-separated value (CSV) files”.

The advisory also called for better staff training for those involved in disclosing information to prevent the exposure of sensitive data. 

UK information commissioner John Edwards said it’s “imperative” that robust measures are maintained by public authorities when dealing with personal information. 

“The advice we have issued sets out the bare minimum that public authorities should be doing to protect personal data when responding to information access requests, and to reassure the people they serve, and their staff, that their information is in safe hands.”

While the ICO did not explicitly cite recent incidents, the advisory notice follows a series of FoI-related data protection blunders at UK police services across the country. 

Personal information belonging to thousands of police officers and staff in Northern Ireland was exposed in August after a document was mistakenly uploaded in response to a freedom of information request.  

The data breach exposed the names of around 10,000 actively serving officers and civilian staff. 

Within the space of a week, this incident was followed by breaches at two other forces elsewhere in the UK. 

Norfolk and Suffolk police revealed a “technical issue” that resulted in personally identifiable information being exposed during a routine freedom of information response. 

Details of hundreds of crime victims, suspects, and witnesses were exposed in the incidents. Much of the information leaked pertained to domestic abuse, assault, theft, and sexual offense cases.

Both police services have since apologized for the data protection blunders.  

“The recent personal data breaches are a reminder that data protection is, first and foremost, about people,” Edwards said. 

“We have seen both the immediate and ongoing impact that the release of such sensitive personal information has had on the individuals and families involved, and that is why I have taken this action.”

Organizations across the UK could face fines for inadvertently copying people into email chains under new guidelines published by the country’s data regulator.

The Information Commissioner’s Office (ICO) has advised businesses to “use alternatives” to the blind carbon copy (BCC) function when sending bulk emails that contain potentially sensitive information.

The warning from the regulator coincides with the publication of new guidance detailing how organizations can improve data protection practices relating to email communications.

Best practice advice from the ICO suggests that organizations using “large amounts of data” should consider using alternative means to the BCC function to prevent exposure of personal information.

The guidance also recommends improving training regimes for staff to cultivate a stronger understanding of data protection regulations and their application in email communications.

Mihaela Jembei, ICO director of regulatory cyber, said the new guidelines will provide organizations with a clear-cut framework for best practices, and warned that those found to be operating negligently could be reprimanded.

“This new guidance is part of our commitment to help organizations get email security right,” she said.

“However, where we see negligent behavior that puts people at risk of harm, we will not hesitate to use the full suite of enforcement tools available to us.”

Responding to recent data breaches

The new guidance comes in direct response to a slew of data breaches related to email communications, which the regulator described as a “catalog of business blunders”.

An investigation into the issue from the ICO found that incorrect use of the BCC function is frequently in the top 10 of non-cyber-related breaches, with nearly 1,000 incidents reported since 2019.

“Failure to use BCC correctly in emails is one of the top data breaches reported to us every year,” Jembei said. “These breaches can cause real harm, especially where sensitive personal information is involved.

“While BCC can be a useful function, it's not enough on its own to properly protect people's personal information. We’re asking organizations to assess the nature of the information and the potential security risks when deciding on the best method to communicate with staff or customers."

Failures were found to be a recurring theme across a range of industries, with organizations in the education sector, healthcare, local government, and retail among the most frequently reported for email-related issues.

The regulator has taken a tougher stance on email-linked data breaches in recent years. In 2022 the Tavistock and Portman NHS Trust was fined £78,400 for exposing the email addresses of over 1,700 gender identity patients.

More recently, it reprimanded two Northern Ireland-based organizations for wrongly disclosing people’s information in an email chain. The ICO also issued a reprimand to NHS Highland in March after data belonging to people accessing HIV services was exposed.

The regulator described the incident as a “serious breach of trust” that put users of the service at risk.

The UK’s Information Commissioner’s Office (ICO) has called for an end to website design practices that it claims could harm users.

The regulator has singled out cookie consent banners as an example of where it will take action if it believes that consumers are being affected by harmful design. It went on to state that it would take enforcement action where it felt design choices would leak to risk or harm.

It said: “The ICO will be assessing cookie banners of the most frequently used websites in the UK and taking action where harmful design is affecting consumers”.

Cookie consent banners made an appearance in response to GDPR requirements. Their purpose is to give users a choice regarding the usage of cookies on a website.

A joint paper, set out in conjunction with the Competition Markets Authority (CMA), has documented how design practices can affect choice and control over personal information.

The design practices worrying the authorities include default settings - where a user must take active steps to change a predefined choice - and bundled consent - where a user is asked for consent for multiple purposes via a single option.

Defaults are among the strongest practices influencing user behavior, according to the ICO and CMA. This is due to the fact that they require less effort from the user compared to making an active choice and implies a recommendation by the company or an indication that most users would choose them.

The ICOs’ concerns relate to Article 25 of the UK GDPR, which requires a ‘data protection by design’ approach to the processing of personal data. Although a ‘default off’ approach is not mandated, not requiring the user to actively consent to more intrusive behavior will likely attract attention.

Similarly, the CMA worries that the use of defaults could lead to users making choices not in their best interests, for example, inadvertently enrolling into auto-renewing subscription plans.

Other practices causing concern include “harmful nudges,” where it is made easy for a user to make a poor choice, alongside “sludge,” where sites make it difficult for a user to select the option they wish. 

The ICO warned that the practice infringed fairness and transparency regulations, although accepted that “nudges” could also be beneficial to users in steering them through to good decisions, with friction or “sludge” also being useful if implemented to ensure a user understands the consequences of their action - for example, validating a bank transfer.

Finally, ‘confirmshaming’ and ‘biased framing’ were also singled out for criticism.

Confirmshaming is where 'good' and 'bad' choices are presented, and the user is therefore made to feel guilty or embarrassed for not choosing the company’s preferred option. Biased framing is where choices are presented in a manner that emphasizes the supposedly positive outcome of a given selection.

The UK’s Electoral Commission has warned that hostile actors have accessed voter data, including names and addresses, belonging to anyone registered to vote in elections between 2014 and 2022.

The attackers gained access to full names, addresses, and the date on which a person achieves voting age – which is 18 for UK parliamentary elections.

The attackers also had access to the commission’s email and control system as well as the names of those registered as overseas voters, but not their addresses, since the organization doesn’t hold this data. Personal data contained in the email system was also affected and includes name, email, address, telephone numbers, and any personal images along with webform data.

The Information Commissioner’s Office (ICO) risk assessment doesn’t suggest that exposing such personal by itself puts individuals at high risk, given much of this information is already in the public domain. But combined with other pieces of information, it could be used to identify or profile individuals.

Webform data or email attachments, meanwhile, could potentially contain sensitive information such as medical or personal financial details.

No group has claimed responsibility for the attack at the time of writing. The Electoral Commission has reported the incident to the National Cyber Security Centre, and said it notified the ICO within 72 hours of identifying the breach.

The fact that systems were first accessed in August 2021, more than a year before suspicious activity was identified, suggests the cyber criminals were patient and possibly surveilling internal operations.

The commission has been quick to reassure voters that the data can’t be used to interfere with the UK’s electoral process, and insisted the exposed data isn’t enough to impersonate a voter under current rules. But the stolen data could help fuel future attacks and other forms of fraud, according to Matt Aldridge, principal solutions consultant at OpenText Cybersecurity.

“If a nation-state actor was at work here, this data could be used to boost any influence campaigns they are running against UK targets in an effort to support that nation’s competitive agenda,” he said.

The potential theft of name and home addresses could be used to contribute to targeted social engineering attacks, for example. Aldridge urged organizations to learn from this breach, check their defenses, and ensure staff are trained in cyber security best practices.

“Rather than viewing data protection as a box-ticking exercise,” he continued, “it should be a key priority and integrated into every aspect of an organization.”

The commission hasn’t disclosed how it became aware of the attack, but said it’s been implementing a number of mitigations: “We have strengthened our network login requirements, improved the monitoring and alert system for active threats and reviewed and updated our firewall policies.”

Over a third (37%) of breaches were caused by human error, and 40% of breaches took more than 72 hours to report, research has found.

An analysis of nearly 100,000 data breaches (99,460) reported to the UK Information Commissioner’s Office (ICO) from April 2019 to December 2022 has found a lengthy gap between the breach and the report, despite the ICO taking a more robust line.

The length of the gap demonstrates the challenges faced in identifying a threat. For 18% of breaches, more than a week passed until the ICO was notified. 

The costs of breaches can be high, dwarfing fines, with research finding the 33 most notable breaches cost organizations more than £13.5 billion, of which only 6% were made up by global regulatory fines.

In this instance, ‘notable’ refers to actual data breaches rather than organizations maliciously abusing data themselves or were reported by white-hat hackers with no damage occurring.

The most common causes of the breaches in the research weren’t cyber attacks. Only a third (33%) of breaches reported were due to malware or phishing, with all breaches caused by threats from outside an organization accounting for 35% of reports. Insider threats, however, came to 40%. 

Human error accounted for more – 23% were caused by data being shared with the wrong person, while 11% was due to lost or stolen data. This includes, for example, stolen devices or paperwork being left in an unsecured location.

Terry Ray, SVP, data security GTM and field CTO of Imperva, noted the ICO’s tougher stance but worries organizations are prioritizing measures that demonstrated compliance on paper, over genuine data security. 

“In many cases, initiatives that meet the letter of compliance will not in fact prevent organizations from suffering the financial impact of a data breach, such as from customer churn and reputational damage, which can dwarf any potential fines,” he said.

Data breaches are rising by more than a third (34%) annually, according to Ray, and he expressed concern that – due to a lack of clear metrics – businesses were unsure their data security investments are paying off.

The ICO has averaged £14.7 million per year in fines issued since it began issuing fines under GDPR rules, compared to £1.5 million levied in the 12 months before GDPR rules came into effect. This increase doesn’t compare favorably with the average cost of the 33 most notable breaches, which was approximately £410 million. “At present,” said Ray, “it would take the ICO 28 years to fine organizations the equivalent of just one of the ‘most notable’ data breaches.”

The Information Commissioner's Office (ICO) has announced that it will be changing its approach to punishing data protection offences committed within the UK’s public sector.

Information Commissioner John Edwards said that the organisation’s regulatory approach will focus more on fixing the underlying issues and that issuing monetary penalties is ultimately counter-intuitive in many cases.

Citing an incident where he was recommended to fine an NHS Trust, Edwards told delegates at the National Association of Data Protection Officers (NADPO) annual conference on Tuesday that fining the Trust would have just harmed the quality of service given to patients, punishing them.

“That fine would have come directly from the money available to that service to deliver services to the victims of the UK GDPR non-compliance,” he said. “We would further punish the very victims whose rights we are there to uphold.”

The same ‘gentler’ approach will be applied across all areas of the public sector, not just the emergency or other critical services.

Issuing fines to organisations in central government is often also ineffective, Edwards said, and previous cases have shown little evidence to support the idea that fines lead to better outcomes or overall compliance.

The Cabinet Office was fined £500,000 by the ICO in 2021 for the 2019 New Year’s Honours breach in which more than 1,000 individuals’ had their home addresses leaked.

It was decided the most effective course of punishment was to reduce this fine to £50,000 after an appeal, given the economic challenges the public sector currently faces.

The Department for Education (DfE) most recently escaped a monetary penalty for its incident in November which saw school pupils’ learning records used by gambling companies to conduct age-verification checks.

Edwards said this would usually garner a £10m fine but the new approach took into consideration that the DfE enacted all the required changes to prevent future data protection breaches of this kind before the ICO could even issue the instruction to do so.

As a result, the department received just a formal reprimand and no fine, a punishment the ICO deemed appropriate given the department’s proactivity in remediating the issues.

“Some commentators have suggested this might be a sign of weakness, or us ‘going easy’ on government. It's not,” said Edwards at the conference.

“My job is to make sure we’re working in the areas that will have the greatest impact. This doesn’t mean always reaching for the most flashy, headline-grabbing action that comes after the fact; sometimes it’s that behind-the-scenes work, the guidance and advice that we can offer businesses to encourage compliance and to help their understanding of the law and their obligations under it."

Monetary penalties will be reserved for organisations that have the potential to harm the most people. Edwards pointed to the recent fines against catalogue retailer Easylife - one worth £130,000 for “predatory marketing calls” and another worth £1.35 million for profiling customers before illegally calling them.

This is an example, Edwards said, of a case where fines can promote compliance - hurting money-making enterprises by impeding their money-making potential.

Further regulatory changes

Another change to Edwards’ approach is to begin publishing all reprimands to the ICO’s website, “unless there is a good reason not to” - something it currently does not do.

This is for the purposes of promoting accountability and transparency - the public and wider economy should be aware of any transgressions and why the ICO issued the punishment it chose.

Non-monetary enforcement actions available to the ICO, aside from fines, include warnings (when violations are likely to be committed), reprimands (formal expressions of disapproval towards conduct when the threshold for a fine hasn’t been met), and compliance orders (instructions to offenders that changes need to be made to re-establish compliance).

Edwards also said he wanted the regulatory process to be more predictable and certain, and the increased emphasis on transparency would help inform organisations what the law requires of them.

In addition, the new approach aims to be more flexible. Tied with the ideas of certainty and predictability, Edwards believes that organisations should be free to innovate their products and services with confidence that they still meet compliance criteria.

The ICO will soon be launching a new advice service dedicated to supporting organisations with their planned innovations in areas to support further investment, like new business models.

“Our advice service will offer direct, fast-paced answers and support to those looking to move quickly and innovate within the guardrails of the law,” he said. “This will do more to improve outcomes for the consumers of those services than aggressive regulatory action after the fact would, after the harm has been done. ”

The UK’s Information Commissioner’s Office (ICO) will renew its focus on regulating algorithmic biases as part of a three-year plan to tackle digital injustices and raise data awareness among businesses.

Branded ICO25, the ICO said the broad “package of actions” will help to save businesses around £100 million over the next three years. It aims to support businesses by releasing a catalogue of learning materials, a database of ICO-approved advice, and an ICO-moderated platform for organisations to discuss compliance matters and share advice.

As part of the roadmap, the ICO is applying a fresh focus on regulating algorithmic biases in the benefits system alongside the of role artificial intelligence (AI) in recruitment. There are fears, in particular, that AI-powered recruitment and hiring may discriminate against neurodiverse job applicants as well as candidates from ethnic minorities.

The use of AI in recruitment has been heavily criticised over the potential to discriminate against certain groups of people, largely due to a marked lack of diversity when such systems are being developed.

Commenting on the strategy, Peter van der Putten, Director AI Lab, Pegasystems and assistant professor in AI at Leiden University said the ICO was right to focus on the impact of AI on material decisions, such as whether you get access to financial support or whether you're hired for a role.

“AI is an invaluable technology that is already being used by government departments, banks, insurers, telcos, utility providers and more to improve customer service for millions of consumers, but these companies cannot let AI go unchecked," he said.

"Improper use of AI in this context is particularly harmful for vulnerable groups, but it is important to realise that virtually anyone can be a victim of unwanted bias, and deserves fair and explainable automated decisions. Take age or gender discrimination for instance.

“That is because AI is as biased as the data and logic used to create it. Even if its designers have the best intentions, errors may creep in through the selection of biased data for machine learning models as well as prejudice and assumptions in built-in logic. Therefore, organisations need to make sure that the data, models and logic being used to create their algorithms is absent of prejudice as much as possible, AI powered decisions are continuously monitored for bias and material automated decisions come with complementary automated explanation facilities."

The ICO's crackdown in this area comes alongside the ongoing support of children’s privacy and a crackdown on nuisance marketing.

“Certainty and flexibility remain the two pillars of what I offer to business today, and in how we will support the successful implementation of a new data protection law,” Information Commissioner John Edwards will say in a speech later today.

“Certainty in what the law requires, coupled with a predictable approach to enforcement action that allows businesses to invest and innovate with confidence. And the flexibility to reduce the cost of compliance.

“That support for business and public sector is important in itself, but it is ultimately a means to an end. We help business to help people.”

Clarifying the £100 million figure, Edwards will say that “flexibility” the ICO refers to is related to the cost of compliance, in light of the fact he's tasked the regulator with saving businesses £100 million over the next three years in the form of opportunities for better understanding data law.

Edwards will also say he understands these new focuses represent a big change in the way the ICO approaches matters, and that some things may not work out as intended. “The proposals I set out today involve trying different approaches. Some may work well, some may not work, some may need tweaking,” he will say. “But it is absolutely clear to me that in a world of increasing demand, and shrinking resources, we simply cannot keep doing what we’ve been doing and expect the system to improve.”

The Information Commissioner also promised to use the “most punitive regulatory tools” at the organisation’s disposal against those who seek to target and exploit vulnerable groups.

The ICO has been previously criticised for failing to investigate major data privacy cases in recent years. It has also been accused of failing to allocate an adequate proportion of staff to tech privacy, fuelling fears that major breaches would go uninvestigated.

The Information Commissioner’s Office (ICO) has said it will take a more lenient approach to public sector organisations as part of its new three-year strategic vision.

This new strategy will see use of the Commissioner’s discretion to reduce the potential economic effect that GDPR fines can have, coupled with an approach that will focus more on sharing lessons learned and promoting good practice. The regulator said that this new strategy will be trialled over the next two years.

In practice, this will mean an increased use of its wider powers, including warnings, reprimands, and enforcement notices, with fines only issued in the most serious cases, the authority revealed this week. It will also mean a number of existing fines against public sector organisations will be substantially reduced, in some cases as much as 90%.

When a fine is considered, the ICO’s decision notice will indicate the amount the fine would have attracted. It hopes this will provide information to the wider economy about the levels of penalty others can expect from similar conduct.

The regulator is also aiming to work more closely with the public ​​sector to encourage compliance with data protection laws and prevent harms before they happen.

“I want to ensure my office remains a pragmatic, proportionate and effective regulator focused on making a difference to people’s lives,” said John Edwards, the UK Information commissioner. “That means taking a more proactive and targeted approach with public authorities to ensure they are looking after people’s information while supporting their communities.”

The UK government has also committed to create a cross-Whitehall senior leadership group to encourage compliance with high data protection standards. The ICO is also going to engage with the Devolved Administrations and the wider public sector to determine the most effective way to deliver these improvements.

The revised approach is part of a set of initiatives known as ICO25, its new three-year strategic vision, which aim to empower organisations to innovate while using people’s data responsibly.

As part of this change, the regulator has issued a reduced fine of £78,400, down from £784,800, to Tavistock and Portman NHS Foundation Trust for disclosing 1,781 email addresses belonging to adult gender identity patients in September 2019.

Additionally, the ICO issued a public reprimand to NHS Blood and Transplant Service, after they inadvertently released untested development code into a live system for matching transplant list patients with donated organs in August 2019. If the revised approach had not been in place, the organisation would have received a fine of £749,856.

“My office worked with both organisations to improve their data protection standards and practices. We used different enforcement tools but, crucially, both resulted in changes that better protect the public,” said Edwards.

This new approach follows the reveal of the UK government's Data Reform Bill, a proposed law that will rework the General Data Protection Regulation (GDPR) to be more flexible and less stringent, according to the government. The bill is set to scrap what the government called “red tape and pointless paperwork," and will also include a restructure of the ICO.

This restructure will force the ICO to consider factors like economic growth, innovation, and competition when making its judgements, instead of solely following the letter of the law.

The UK's Ministry of Justice (MoJ) has been served an enforcement notice by the Information Commissioner's Office (ICO) for failing to address and respond to a growing backlog of Subject Access Requests (SARs).

The MoJ is said to have contravened Chapter 3, Article 15 of the EU and UK GDPR, and section 45 of the Data Protection Act 2018, and has now been ordered to develop a recovery plan that includes details of how to remedy the outstanding SARs, and "take appropriate steps" to ensure future SAR submissions are timely notified of any delays to a response.

The ICO said it issued the enforcement notice after considering, and agreeing, that "damage or distress is likely" as a result of the delay in SAR processing, which meant subjects were "being denied the opportunity of properly understanding what personal data may be being processed about them by the controller". Data subjects were also deemed to have been unable to exercise their statutory rights in respect to their data.

At its peak, it's believed the subject access request backlog had grown as high as 7,753.

The ICO acknowledged the difficulties faced by the MoJ, especially as pandemic restrictions limited affected its ability to process SARs. However, the "substantial number" of SARs that are out of time for compliance was "a cause of significant concern for the Commissioner," the ICO said in the enforcement notice.

It also added that "previous meetings and correspondence between the controller and commissioner have proven largely ineffective in reducing the number of outstanding SARs".

Failure to meet the demands of the enforcement notice will result in a fine of £17.5 million or 4% of its annual global turnover, whichever is higher. The MoJ has 28 days to appeal the notice.

"We take our responsibilities seriously and have set out an action plan to clear the backlog," an MoJ spokesperson told IT Pro."

"The MoJ devotes significant resources to meeting these legal obligations, and we have hired extra staff to assist in clearing outstanding requests," they added. "The pandemic has had an unprecedented impact on our work, but we responded quickly and adapted ways of working to continue to provide a level of service to requestors.

"We have engaged in constructive dialogue with the ICO before and throughout the pandemic and have a clear action plan we have in place to clear the backlog."

Timeline of events

The ICO originally became aware of a backlog at the MoJ on 7 January 2019, which resulted in conversations with the data controller over the following year. This almost led to an enforcement notice being issued - a formal exercise of the Commissioner's powers for violations of data protection law - which was ultimately delayed due to the pandemic.

According to the ICO, the pandemic "led to a shift in Commissioner's approach to regulatory action" and saw the investigation into the MoJ paused. New societal restrictions affected the MoJ's ability to respond to the backlog of SARs, the data controller told the ICO in an October 2020 update. Urgent cases were being prioritised, such as those affecting legal proceedings, police investigations, and immigration hearings.

The ICO said contact between it and the MoJ resumed in March 2021 and by April, it became aware that the MoJ was facing 5,956 outstanding SARs to which the MoJ had only partially responded. A total of 372 of these dated back as far as 2018.

Regular progress updates from the MoJ regarding how it was addressing the backlog were then requested by the ICO and by May 2021, the backlog had grown to 6,398. The backlog grew further to 7,753 by August 2021 after the MoJ said it predicted the resumption of a full SAR service by "summer/autumn 2021". It also said that of the near-8,000 outstanding cases, 25 received no response at all and around 960 predated the pandemic.

The MoJ promised to address the pre-pandemic cases first, setting itself a deadline of 31 May 2022, after which time it "will then move forward with plans to revisit the remaining 6,772 partial response cases in the timeliest way achievable".

The Information Commissioner's Office (ICO) has fined the Cabinet Office £500,000 for a 2020 data leak that exposed the full names and addresses of the New Year Honours recipients on its gov.uk web page.

More than 1,000 people were affected by the leak, with some complaining that they felt concerned for their personal safety. Notable inclusions in the list were Sir Elton John, Dame Olivia Newton-John, and Sir Iain Duncan Smith.

The ICO concluded the Cabinet Office had breached the Data Protection Act 2018 as a result, and was punished according to the rules set out by the General Data Protection Regulation (GDPR).

It was also found that the Cabinet Office failed to implement the appropriate technical and organisational measures in its IT systems to protect the data of those affected.

"When data breaches happen, they have real life consequences," said Steve Eckersley, ICO Director of Investigations. "In this case, more than 1,000 people were affected. At a time when they should have been celebrating and enjoying the announcement of their honour, they were faced with the distress of their personal details being exposed.

"The Cabinet Office’s complacency and failure to mitigate the risk of a data breach meant that hundreds of people were potentially exposed to the risk of identity fraud and threats to their personal safety," he added.

“The fine issued today sends a message to other organisations that looking after people’s information safely, as well as regularly checking that appropriate measures are in place, must be at the top of their agenda."

The IT system in question was implemented in 2019 but was misconfigured, according to the ICO. It generated a .CSV file for the New Year Honours list, which included full names and corresponding home addresses, before posting it online.

The team responsible for generating and publishing the list were under tight deadlines, the ICO reported, and instead of fixing the system, it attempted to amend the file instead. However, each time a new file was generated, the .CSV file included full addresses.

Despite removing the file shortly after posted it online, a cached version remained accessible to the public. The ICO reported the file was accessed 3,872 times in the period of two hours and 21 minutes that it was online.

The Cabinet Office confirmed that there were no specific or written processes in place at the time to sign off documents and content containing personal data prior to being sent for publication.

The ICO acknowledged the swiftness of the Cabinet Office's response and undertook a full incident review, which has led to operational and technical improvements, and an independent review launched into the incident.

"The Cabinet Office would like to reiterate our apology for this incident," it said in a statement to IT Pro. "We took action to mitigate any potential harm by immediately informing the Information Commissioner and everyone affected by the breach.

"We take the findings of the Information Commissioner very seriously, and have completed an internal review as well as implemented a number of measures to ensure this does not happen again. This includes a review of the overall security of the system, information management training and improving internal processes for how data is handled by the honours team.”

The Information Commissioner's Office (ICO) unveiled new mandatory data protection standards for the advertising technology (adtech) industry on Thursday.

New rules apply to companies designing new methods of online advertising and stipulate data protection laws must be followed and excessive data collection must cease, in line with the UK's Data Protection Act 2018.

The ICO published a Commissioner's Opinion which states data protection of users must be placed at the forefront of any advertising strategy designed by adtech firms.

“Ultimately, new online advertising proposals should improve trust and confidence in the digital economy, instead of weakening it,” the Opinion reads. “Solutions should be privacy-respectful while ensuring they give due consideration to other relevant laws.”

Users will have to be given clear opportunities to receive ads without tracking, profiling, or targeting based on excessive collection of personal data, the ICO said.

Accountability throughout the entire data collection and processing lifecycle is also now mandatory, with companies having to prove who is responsible for what task at each stage of the advertising strategy.

Each strategy must clearly identify the purposeful processing of personal data and consider ways to reduce harm and mitigate risks to individual users before any processing takes place.

Adtech companies must be fair and transparent about the benefits of data collection, articulating this to the users explicitly, and afford users ‘meaningful control’ over processing where possible.

The standard data collection and processing rules as set out by the Data Protection Act 2018 will also apply, such as the principle of data minimisation.

"What we found during our ongoing adtech work is that companies are collecting and sharing a person’s information with hundreds, if not thousands of companies, about what that person is doing and looking at online in order to show targeted ads or content," said Elizabeth Denham, information commissioner at the ICO. "Most of the time, individuals are not aware that this is happening or have not given their explicit consent. This must change.

"I am looking for solutions that eliminate intrusive online tracking and profiling practices, and give people meaningful choice over the use of their personal data," she added. "My office will not accept proposals based on underlying adtech concepts that replicate or seek to maintain the status quo."

It said Google's Privacy Sandbox is currently one of the leading proposals in the industry and that the ICO is currently working with the Competition and Markets Authority (CMA) to review how the model can be applied in the UK.

Google's Privacy Sandbox aims to replace the use of third-party cookies with other technologies to enable digital advertising. The project is currently subject to antitrust allegations in the US and EU as it forces advertisers to work with Google on ads.

The ICO drew attention to failings in the adtech industry in 2019 saying it found massive illegality in the space with numerous violations of data protection laws, particularly with real-time bidding.

Despite this, the data regulator was threatened with legal action from the Open Rights Group alleging it had failed to enforce data laws against adtech firms falling foul to data laws.

The threat of legal proceedings prompted the ICO to restart its probe into the industry after it was initially paused, saying it didn’t want to put undue pressure on the industry as the COVID-19 pandemic started to take hold in the UK.

London-based diamond specialist Graff has reportedly been hit by a ransomware attack, prompting an investigation from the Information Commissioner's Office (ICO).

The attack is believed to have been carried out by Conti, an infamous Russia-based ransomware group that has also been blamed for a recent uptick in attacks across the US.

A total of 69,000 documents have been leaked on the dark web already, a number which represents just 1% of the total files Conti has stolen, the hacking group claimed. The list of victims includes high-profile names such as ex-footballers David Beckham and Frank Lampard, former president Donald Trump, actors Tom Hanks and Samuel L Jackson, and disgraced businessman Sir Philip Green, according to the Mail on Sunday, which first reported the story.

“We have received a report from Graff Diamonds Limited regarding a ransomware attack," said the ICO, in an email to IT Pro. "We will be contacting the organisation to make further enquiries in relation to the information that has been provided."

It's believed 11,000 of the company's customers may be affected, 600 of which are UK nationals, according to the Mail on Sunday. Information such as client lists, invoices, receipts, and credit notes were included in the hack.

In some cases, customer names and addresses used for billing and shipping were included, and in other cases details of what the customer bought - and the cost of said items - were leaked online.

Conti is believed to be demanding a sum in the tens of millions in order to prevent the further release of customer information, however Graff has said it has been able to rebuild and restart its systems with no permanent loss of customer data.

"Regrettably we, in common with a number of other businesses, have recently been the target of a sophisticated – though limited – cyber attack by professional and determined criminals," said Graff in a statement. 'We were alerted to their intrusive activity by our security systems, allowing us to react swiftly and shut down our network. We notified, and have been working with, the relevant law enforcement agencies and the ICO.

'We have informed those individuals whose personal data was affected and have advised them on the appropriate steps to take."

Conti's recent surge in activity prompted the US' CISA, FBI, and NSA to release a joint advisory to US and international businesses alerting them to the group's most common attack methods.

These include spearphishing campaigns, exploiting stolen or weak remote desktop protocol (RDP) credentials, fake software promoted though web adverts, and common vulnerabilities in external assets.

The attack follows a string of major raids on international businesses attributed to Conti. Nokia subsidiary SAC Wireless said it had become victim to a Conti ransomware attack in June, while 16 US healthcare and first responder organisations were also targeted just one month prior.

The Information Commissioner's Office (ICO) is launching a risk assessment toolkit for businesses so they can check if their use of artificial intelligence (AI) systems breaches data protection laws.

The AI and Data Protection Risk Assessment Toolkit, available in beta, draws upon the regulator's previously published guidance on AI, as well as other publications provided by the Alan Turing Institute.

The toolkit contains risk statements that organisations can use while processing personal data to understand the implications this can have for the rights of individuals. It will also provide suggestions for best practices that companies can put in place to manage and mitigate risks and ensure they're complying with data protection laws.

It's based on an auditing framework, according to the ICO, which was developed by its internal assurance and investigation teams following a call for help from industry leaders back in 2019.

The framework provides a clear methodology to audit AI applications and ensures they process personal data in compliance with the law. The ICO said that if an organisation is using AI to process personal data, then by using its toolkit, it can have high assurance that it is complying with data protection legislation.

"We are presenting this toolkit as a beta version and it follows on from the successful launch of the alpha version in March 2021," said Alister Pearson, the ICO's Senior Policy Officer for Technology and Innovation Service. "We are grateful for the feedback we received on the alpha version. We are now looking to start the next stage of the development of this toolkit.

"We will continue to engage with stakeholders to help us achieve our goal of producing a product that delivers real-world value for people working in the AI space. We plan to release the final version of the toolkit in December 2021."

The ICO has urged anyone interested in testing the toolkit on a live AI application to get in contact with the regulator via email (AI@ico.org.uk).

More than 20 MPs across four political parties have accused the UK's data regulator of failing to hold the government to account over privacy failures in the NHS Test and Trace system.

The politicians want the Information Commissioner Elizabeth Denham to consider fining the government after it admitted that it failed to conduct a legally required impact assessment on privacy, according to The Guardian.

A letter signed by 22 MPs suggests the government should receive a penalty "if it fails to adhere to the standards which the ICO is responsible for upholding".

Liberal Democrat MP Daisy Cooper, one of the letter's signatories, said the government had "seemingly played fast and loose with data protection measures" during the pandemic.

"The public needs a data regulator with teeth: the ICO must stop sitting on its hands and start using its powers - to assess what needs to change and enforce those changes - to ensure that the government is using people's data safely and legally," she said.

The letter was arranged by the Open Rights Group, which successfully forced the government to admit its failure to perform a data protection impact assessment. It features signatures from the Labour, the Lib Dems, Green and Scottish National Parties.

"There is something rotten at the heart of the ICO that makes them tolerate government's unlawful behaviour," said Jim Killock, executive director of the Open Rights Group.

"The ICO is a public body, funded by the taxpayers, and accountable to parliament. They must now sit up, listen and act. As a regulator, ICO must ensure that the government upholds the law."

In July, the government conceded that its contract-tracing programme had been operating unlawfully since it launched on 28 May. In a letter to campaigners, a government solicitor stated that NHS Track and Trace was developed at such pace and scale that it wasn't anywhere close to a primary focus.

"The Johnson government brought this programme forward more quickly than was practical, and we are all paying the consequences. Privacy is fundamental to trust," said Clive Lewis, the Labour MP for Norwich South.

The UK data regulator has said it will adopt a lighter touch while organisations weather the economic effects of COVID-19, meaning fewer investigations and reduced fines.

When issuing fines for Data Protection Act 2018 and GDPR breaches, the Information Commissioner’s Office (ICO) will now take into account whether an organisation’s financial difficulties result from the coronavirus crisis.

As such, businesses found to have committed data protection violations may be given longer than usual to rectify breaches that predate the crisis, where the crisis has affected its ability to put things right.

The regulator will also reduce the level of fines it issues, according to fresh guidance, meaning we aren’t likely to fines of the same scale as those levied against British Airways and Marriott last year.

BA and Marriott were each delivered notices of intent to fine £183 million and £99 million in 2019 for data breaches committed after GDPR came into force. The ICO has prolonged the collection of these fines to May 2020, however, after several delays.

“We see the organisations facing staff and capacity shortages. We see the public bodies facing severe front-line pressures. And we see the many businesses facing acute financial pressures,” said the Information Commissioner Elizabeth Denham. “Against this backdrop, it is right that we must adjust our regulatory approach.

“It is important that we regulate for the time we are in now, but it is important too that we look to the future. Data protection can play a central role in promoting economic growth when we come out of this pandemic: encouraging public trust in innovation and supporting the UK as it steps forward in the global economy.”

The COVID-19 pandemic has affected different kinds of organisations in different ways, with many struggling to stay in business, while others are migrating their workforce to remote working patterns.

The data regulator’s intervention suggests it sees its role as one that’s dynamic and responsive to the wider economic situation, and that its priority is not to financially cripple businesses who violate the DPA.

Some things will remain the same, such as a limit of 72 hours being given for organisations to report a data breach, although guidance suggests there may be some leeway, because “the current crisis may impact this”.

When conducting investigations, moreover, the ICO will act in the context of the public health emergency and take into account the financial and staffing impact of the crisis on every business it examines.

In practice, this means a reduction in the use of formal powers to compel organisations to provide evidence, and allowing longer periods for them to respond. The ICO will also conduct fewer investigations overall, focussing its attention instead on those circumstances which suggest serious non-compliance.

In addition, the ICO may not act against organisations that fail to pay or renew data protection fees if this is successfully linked with the economic consequences of COVID-19.

All audit work, meanwhile, has been suspended, and all regulatory action in connection with outstanding information request backlogs has also been paused. Businesses have also given some leeway on fulfilling Subject Access Requests (SARs), with the regulator noting that staff may need to prioritise other work during the crisis.

By watering down these considerations for action, and offering more flexibility for businesses that don’t stick by the rules, however, the ICO leaves itself open to the accusation it’s softening the deterrent against breaching GDPR.

However, global co-head of the privacy and cyber security practice at Hogan Lovells, Eduardo Ustaran, argues the ICO is simply providing reassurance at a time of great uncertainty.

“The ICO is not saying that it will not fulfil its regulatory duties or enforce the law, but that it will take into account the hardships that many organisations are facing when undertaking those duties,” he said.

“It would be a mistake to think that the regulator's words mean that this is a "free for all" scenario and extremely disingenuous of anyone to do so. As ever, data protection law needs to be looked at through the lens of common sense, and today that means taking into account the effect that the coronavirus crisis is having on everything.”

He added it’s clear the ICO won’t stop “doing their job”, and that the organisations will continue to take firm action against those looking to exploit the situation by misusing personal information.

The General Data Protection Regulation (GDPR) came into force on 25 May 2018 to give individuals more control over their own data and impose strict limitations on how organizations can use personal information.

In an era where personal data has massive value to businesses, how this information is collected, stored, processed, and shared is now governed by the core principles of GDPR. Within the European Union, these principles are enforced by data regulators, and within the UK by the ICO (Information Commissioner's Office).

Until GDPR, how businesses use the personal data of their customers was largely unregulated. Data scandals such as the Cambridge Analytica incident showed that companies could, if unchecked, use this information to influence behaviour without the express permission of the person who owns that data.

GDPR helps to clarify how businesses and organizations should collect personal data and where this should be stored, including for businesses trading across national borders. The regulation applies to all businesses operating across each EU Member State, and to any business processing data belonging to an EU citizen. 

The regulation also brings much tougher sanctions for those businesses found to have fallen foul of the rules. Relevant data regulators now have the power to fine a business up to €20 million, or 4% of global annual turnover, whichever is higher.

The UK is in a somewhat unique position given its previous relationship with the EU. The UK was developing its own data protection legislation in line with GDPR as part of its commitment as an EU Member State. Following Brexit, the UK continued this work in order to achieve adequacy status with the EU and maintain vital data flows. The result was the Data Protection Act 2018, which became the mechanism through which GDPR was incorporated into UK law - hence why it's often referred to as UK GDPR.

So long as businesses in the UK fully comply with the Data Protection Act 2018, your business will also be fully compliant with GDPR.

Why was GDPR implemented?

Over the course of the last quarter-century, the web and the movement of data has cemented itself as a fixture in the operations of countless businesses. The rise of social media platforms, which host and exhibit vast amounts of personal data, have also called into question the need for a set of data protection laws that are fit-for-purpose in the modern age.

It’s clear why rules such as those outlined with GDPR were required, given how some of the world’s biggest tech companies conduct their business. Several platforms, for many years, have offered services that are free to use but request personal and private data from their users, which are then processed and monetised. People aren’t paying when they use Google’s search engine - but their actions and movements are recorded, and converted into data points. These are seen as being very valuable for third parties and are especially sought-after for purposes such as targeted advertising

In the past, this type of data collection was often masked by unclear tick boxes or opt-in buttons. You might not even remember agreeing to them, and you almost certainly wouldn't have read the associated terms and conditions, but its the reason you receive emails that aren't completely in line with your interests.

Perhaps the most egregious example of data misuse was Facebook's Cambridge Analytica scandal, which dominated news headlines in early 2018. In that case, user data was found to have been improperly shared with a third party app, which then used this to target users with advert campaigns said to influence the outcome of the 2016 US election.

A separate aim of GDPR is to make it easier and cheaper for companies to comply with data protection rules. The EU's 1995 directive allowed member states to interpret the rules as they saw fit when they turned it into local legislation. This meant that data protection laws were inconsistent across the bloc, making data transfers overly cumbersome. The nature of GDPR as a regulation, and not a directive, means it applies directly without needing to be turned into law, creating fewer variations in interpretation between member states. The EU believes GDPR will not only create smooth data flows but also collectively save companies £2.3 billion a year.

When did GDPR come into effect?

GDPR came into effect on 25 May 2018, applying automatically to all member states and any international organisation that deals with customers and clients that are residents of the EU. Because GDPR is a regulation, not a directive, the UK did not need to draw up new legislation instead, it applied automatically.

With the UK now preparing to leave the European Union, the UK has also introduced new data protection legislation under the Data Protection Act 2018. This new act covers certain provisions that are not part of GDPR, such as processing relating to immigration and automatic processing in public bodies. GDPR will be implemented into UK law as part of the European Union (Withdrawl) Act, and will sit alongside the DPA 2018 going forward. This has been necessary in order to demonstrate the UK has robust enough data protection laws in place to protect EU data - needed in order to secure an adequacy agreement with the EU post-Brexit.

Who does the GDPR apply to?

If you don't think you need to respect the GDPR legislation, you're likely to find yourself in hot water sooner or later. Whether your business operates with clients in the EU or outside it, it's vital you respect the rules and make sure you're compliant with regulations.

Pretty much every business must comply with the EU's data laws, even if they're based in the US. This is because most companies have at least some data belonging to EU citizens stored on their servers. In order to process that data, the organisation must comply with GDPR principles.

However, if you truly have no dealings with the EU, you can avoid having to comply using a traffic filter. By blocking any EU traffic to your website, you can make sure that only non-EU traffic is allowed to your website and only those outside Europe can enter their details onto your site.

It obviously a technique only relevant for businesses that do not need contact with EU citizens, such as US-based news sources. The LA Times is one company that has implemented this GDPR avoidance scheme.

What are data controllers and data processors?

Every business operates as either a data controller or data processor, and often both at the same time. 

Data controllers

A data controller is responsible for determining how and why data is collected, and for establishing how data should be processed. This means a controller could be any organization, from a high street retailer to a global manufacturing giant to a charity. Although they are ultimately responsible for how the data is handled, they are not necessarily the collector of that data. 

Your business' data controller must show that your company has lawfully collected personal data. What 'lawful' means to your business must be defined carefully as it can be interpreted. If your business is unsure, consulting the ICO for clarity is essential to avoid what could be potentially heavy fines.

Unlike older data protection laws, the controller and the processor are jointly liable for financial penalties in case of a data breach or if the processor is found to have handled data illegally.

Data processor

Data processors are any entities that 'process' data on behalf of a data controller. Managed service providers (MSPs) are one of the most common third-party data processors you're likely to encounter, however a data processor can also exist within the same company as a controller.

Data processors have their own compliance requirements, including maintaining robust records of their processing activities, however they are required to only process data within the scope established by the data controller.

It's important to note that what dictates whether an entity is a controller or processing is entirely dependent on the relationship that entity has with the data. In some cases, a business may be a data controller while simultaneously providing data processing services for other companies. Likewise, a data processor can also be a controller for another set of data. 

For example, every business is considered a data controller in the context of employee data.

How can I process data under the GDPR?

GDPR states that controllers must make sure it's the case that personal data is processed lawfully, transparently, and for a specific purpose.

That means people must understand why their data is being processed, and how it is being processed, while that processing must abide by GDPR rules.

How do I get consent under the GDPR?

Consent is at the core of the changes in how data is collected. Gone are the days when your company could assume consent to collect and use a customer's data. 

Consent must be an active, affirmative action by the data subject. For example, your business can't offer a pre-ticked box for collecting personal data. The owner of that information must physically give their consent, which, in turn, must be recorded by your business.

Individuals have the right to withdraw consent and the right to be forgotten. There can be various reasons for this, but whatever these are, GDPR compels your business to delete this information and inform any other parties that are using this data to also delete the information from their systems.

Consent is generally thought of as being the weakest legal basis for processing data, as consent can be removed at any time and thus grind processing to a halt. Unless your business is involved with media or marketing (or those similar industries where consent is required), consent should be your last option.

What counts as personal data under the GDPR?

The type of data that falls under GDPR has also been expanded. Generally, any data that can identify an individual now comes under GDPR, including data such as IP addresses. Pseudonymized personal data may also be subject to GDPR rules, depending on how easy or hard it is to identify whose data it is.

This includes:

• Names
• Addresses
• An identification number
• Location data
• Anything relating to the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person

When can people access the data we store on them?

The new data protection laws strengthened one key aspect of the legislation that gives citizens the right to access the data organisations hold. Anybody, under GDPR, can submit a subject access request (SAR) to an organisation. This data controller will then have 30 working days in which to provide a full response.

The provision was already part of UK law under the Data Protection Act 1998, but the time period stood at 40 working days. Failure to comply with the reduced windows also exposes companies to regulatory action under the stricter terms of the GDPR. Twitter, for example, was subject to a GDPR investigation for failing to provide users with the information they requested under this provision. The rule only applies, however, if the requests are deemed reasonable, as there are certain exemptions.

The data protection laws say controllers and processors must identify clearly how users' data is collected, what it's used for, and how it's processed. Any communications outlining this information, moreover, must be in clear and plain English so there's no risk of confusion on the part of users.

Submitting SARs are, in effect, a mechanism individuals can use to express their power under the law, to hold companies to account over how they use their data. It gives them the right to understand how their information is handled, and for what reasons. Customers can also ask for data to be removed, completed or brought up to date at any time if deemed incorrect.

What is the Right to be Forgotten?

GDPR makes it clear that people can have their data deleted at any time if it's not relevant anymore - i.e. the company storing it no longer needs it for the purpose they collected it for. If the data was collected under the consent model, a citizen can withdraw this consent whenever they like. They might do so because they object to how an organisation is processing their information, or simply don't want it collected anymore.

The controller is responsible for telling other organisations (for instance, Google) to delete any links to copies of that data, as well as the copies themselves.

How to report a data breach under GDPR

Under GDPR, a data breach constitutes any breach of security that leads to the accidental or unlawful loss, destruction, alteration, disclosure of, or unauthorised access to personal data.

However, only those breaches that are likely to lead to the infringement of the rights and freedoms of individuals are required to be reported to the ICO; organizations are not required to report every incident.

Regardless of the nature of the breach, an organization must take steps to contain it and establish its severity. As part of this process, the company must undertake a risk self-assessment.

If a data processor experiences a breach, it is required to inform the controller as soon as it becomes aware of the incident. Establishing these obligations as part of a contract is important, as both the controller and the processor will be liable for any failure to communicate the details of a data breach.

Affected parties have up to 72 hours to inform the ICO if they believe the breach risks the rights and freedoms of data subjects. Any failure to adhere to this timeframe will need to be justified. Affected parties can call the ICO on 0303 123 1113. They can also report a breach online, but only if they feel they have already dealt with the incident appropriately.

When reporting the breach, the following information must be provided:

• A description of the breach, including (if possible) the approximate number of people affected and the types and volume of personal records involved
• The contact details of the affected organisation's data protection officer, or those of a contact that can provide further information
• A description of the potential consequences of the breach
• A description of the various measures the organisation has taken to deal with and mitigate the effects of the breach

Some of this information may not be available within the 72-hour timeframe, so Article 33(4) allows for affected parties to provide details in phases, provided this is done without undue delay. However, any delay will need to be explained, and the party is still required to inform the ICO of a breach within 72 hours if deemed severe enough.

What are the fines for breaches of GDPR?

GDPR massively increases the ceiling of fines. First of all, your organisation faces a penalty of up to 2% of their annual turnover, or £10 million, for failing to report a data breach to the ICO within 72 hours of becoming aware of it. 

That initial contact should outline the nature of the data that's affected, roughly how many people are impacted, what the consequences could mean for them, and what measures you've already actioned or plan to action in response. It's worth noting that the window is a fixed 72 hours after the discovery of an incident, and not 72 working hours, as some companies have been led to believe.

Then there is the fine for a breach of personal data itself. Data breaches under GDPR could be punished by a maximum fine of 4% of your organisation's annual turnover, or £20 million, whichever is higher. In the UK, this translates to £17.5 million.

You can read our article on GDPR fines for more information on this, but the regulation does make clear that fines must be "proportional", therefore you're unlikely to face the most severe penalty if it's a minor breach, or if you can demonstrate you are largely compliant with the legislation. The ICO itself has said it views fines as a "last resort".

GDPR certainly has teeth, as the fines already handed out have been substantial. For example, in 2023, Meta was fined €1.2 billion for not managing data transfer from Europe to the USA. Meta is appealing the fine.

The Luxembourg National Commission for Data Protection (CNDP) issued a €746 million ($888 million) fine to Amazon.com Inc. This fine resulted from 10,000 complaints against Amazon in May 2018 through La Quadrature du Net, a French privacy rights group that promotes and defends fundamental freedoms in the digital world.

In 2023, the ICO fined TikTok Information Technologies UK Limited and TikTok Inc. £12.7 million for mishandling children's data. The company used the personal data of children under 13 without their parent's consent.

In 2024, Amazon France Logistique was fined €32m for excessively monitoring their employees by the French Data Protection Authority (CNIL). The company runs Amazon's warehouses in France, where employees have devices that track their movements. The CNIL concluded that the data collected was often not needed and that the data was poorly managed, with employees not being informed about the video surveillance they were under.

Did Brexit affect GDPR?

Because the UK government only triggered Article 50 in March 2017, which had set in motion the act of leaving the EU within a two-year timeframe, GDPR was actually implemented before the legal consequences of the Brexit vote. The UK was still required to comply, and subsequently enshrined the principles of GDPR into UK law.

• GDPR and Brexit: How will one affect the other?

What is the best approach for complying with GDPR?

Ultimately, GDPR is about protecting the personal data your company collects, stores, manipulates, transfers, and sells from unlawful use. It aims to put the power back into the hands of the data owners, who must now give your business explicit permission to use their data.

Paying close attention to the main principles of GDPR, assessing how they impact your business, and then making changes to processes should ensure full compliance. 

Appointing a data protection officer is usually an excellent first step and will give your company a single point of contact for GDPR compliance.

The Information Commissioner's Office (ICO) is the UK's data protection watchdog charged with enforcing a host of laws that regulate communications, networking and data protection, although the organisation is most renowned for its role in enforcing the EU's General Data Protection Regulation (GDPR). The ICO is tasked with making sure that businesses within the UK are compliant with strict data protection principles.

The regulator has a number of roles and responsibilities, including investigating organisations that have suffered data breaches, imposing penalties where appropriate, and generally auditing companies for their data collection and storage practices. The ICO also regularly publishes reports on the state of data protection in the UK, emerging threats to the landscape and updates to how it operates.

A number of large organisations have felt the wrath of the ICO in recent years, with Uber, Equifax and Facebook are among the companies issued with maximum fines under the previous legislation. The prospect of massive fines under GDPR, however, have made businesses more alert to reporting incidents, with the watchdog revealing recently that companies were over-reporting data breaches, seemingly out of fear of being as compliant with the legislation as possible.

The history of the ICO

Founded in 1984 as the Data Protection Registrar, the first leader of the organization was Eric Howe. Howe created the first database – the register of data users after the introduction of the Data Protection Act 1998 (DPA). Howe's work raised public awareness around the importance of data protection and the ways businesses collect data about their customers and commercial partners.

Howe was instrumental in raising the profile of the Data Protection Registrar, leading the prosecution of several companies that were found to have inadequate systems to protect the personal data they were collecting. These prosecutions sent a message to all businesses that the registrar had the power to investigate and fine companies in breach of the DPA. Howe retired in 1994 after being awarded a CBE for his services.

In the 1990s, the registrar conducted an internal audit to define further its role in society and its relationship with businesses. This work also ensured that the registrar could adequately enforce the Data Protection Act, which came into force in 1998. In 2000, the Data Protection Register changed its name to the Information Commissioner's Office (ICO) to reflect the changes in the collection, storage, manipulation, exchange, and sale of data. The ICO also began to oversee the Freedom of Information Act.

The ICO we know today has a head office in London, with additional offices in Scotland, Wales and Northern Ireland. With a staff of over 500, the ICO is led by the Commissioner, John Edwards, who took up his post on 3 January 2022. The management board of the ICO also includes several deputy commissioners and non-executive directors.

The ICO is primarily funded through the data protection fees paid by organizations, which account for over 85% of its annual expenditure. Government grants-in-aid supplement this funding to support the ICO's regulation of other laws. Under the Data Protection Act 2018, organizations processing personal data must pay a data protection fee unless exempt. Personal data includes information such as names, addresses, or telephone numbers. 

From 1 April 2022 to 31 March 2023, the ICO collected approximately £66 million through the data protection fee, up from £62 million in the previous year. Additionally, the ICO's regulation of other legislation is funded by grant-in-aid, receiving £10,298,000 from April 2022 to March 2023, compared to £7,578,000 in 2021/22.

Who is the Information Commissioner?

The Commissioner is the most senior official at the ICO. Appointed by the Crown, there have been six Commissioners:

The Commissioner is also not a neutral party. Able to influence debate and even policy, the Commissioner oversees data privacy rights. 

For example, with the rise of LFR (live facial recognition) technologies, the Commissioner openly stated that the technology poses "a potential threat to privacy." 

In a blog post, then Commissioner, Elizabeth Denham, said: "We understand the purpose is to catch criminals. However, these trials also represent thousands of people's widespread processing of biometric data as they go about their daily lives. I believe that there needs to be demonstrable evidence that the technology is necessary, proportionate, and effective considering the invasiveness of LFR."

What are the responsibilities of the ICO?

The key responsibility of the ICO is to enforce the Data Protection Act 2018 and, by extension, GDPR. However, the ICO is also the enforcement organization for several other pieces of legislation, including:

• Privacy and Electronic Communications (EC Directive) Regulations 2003
• The Freedom of Information Act 2000
• Environmental Protection Public Sector Information Regulations 2004
• Investigatory Powers Act 2016
• Enterprise Act 2002
• The eIDAS (Electronic Identification and Trust Services) Regulation 2014
• Re-use of Public Sector Information Regulations 2015
• The Network and Information Systems Regulation 2018

All of these regulations have the collection and management of data at their core. The ICO, in effect, policies these Acts and regulations to safeguard personal privacy in an environment where data has become highly valuable. The lesser-known eIDAS is important to oversee, as this regulation governs the use of cookies and how digital services are secured.

What powers does the ICO have?

When GDPR came into force, many news headlines covered the substantial fines businesses could face for any breach of the regulations. 

The maximum statutory fine is $23 million (£17.5 million) or 4% of the business's annual turnover – whichever is the higher.

In 2023 alone, ICO fines topped $18 million (£14 million), with the largest fine being handed to TikTok for breaching the personal data privacy of children using their platform. The reality is that the ICO will consider many factors before deciding on the level of fine for the breach or infringement.

The ICO states: "Fines aren't suitable for every breach. Our fines and penalties may grab the headlines, but we know that our work with organizations, helping you to make changes and improvements to comply with the law, is the most effective way of reducing mistakes and misuse of people's data. We're here to help you get data protection right, through our events and our support and advice services. If things go wrong, we want to work with you to decide what improvements we expect from you and provide advice to help you get it right in the future."

Recently, the ICO has been consulting on its Data Protection Financing Guidance, which closed in November 2023. The results of this consultation and the responses from the ICO should be read by all data controllers to understand the five-point process the ICO will use to decide on the appropriate level of fine.

The ICO's powers are far-reaching. The Commissioner can comment on legislation and technologies in development that could impact data privacy. The ICO often makes spot checks to assess how businesses are managing their data protection responsibilities, such as whether DPIAs (Data Protection Impact Assessments) are being carried out regularly.

As a data privacy watchdog, the ICO can prosecute or levy fines. However, the ICO has always striven to avoid being too adversarial. Indeed, it has developed many resources to help businesses more easily comply with data protection regulations.

How the ICO plans to adapt to new technology

The ICO must adapt to rapidly evolving technological and regulatory landscapes to meet future data privacy needs. This includes the rise of artificial intelligence (AI), machine learning, and the Internet of Things (IoT). This will require developing advanced technical expertise to evaluate and regulate these technologies, ensuring they are used responsibly and ethically.

With data flows crossing borders, aligning with global data protection standards and fostering cooperation with international regulators will be crucial. This can help address the challenges posed by global data breaches and multinational corporations' data practices. Empowering individuals with knowledge about their data rights and how to protect their personal information is essential. The ICO can enhance its outreach programs and leverage digital platforms to engage with the public more effectively.

As the value of personal data increases, the large data aggregators will continue to come under the spotlight of the ICO. Meta's plans to train AI's on the personal data they hold of billions of users was tempered by the ICO, with Stephen Almond, executive director of Regulatory Risk at the ICO, stating in June 2024: 

"We are pleased that Meta has reflected on the concerns we shared from users of their service in the UK and responded to our request to pause and review plans to use Facebook and Instagram user data to train generative AI. In order to get the most out of generative AI and the opportunities it brings, it is crucial that the public can trust that their privacy rights will be respected from the outset. We will continue to monitor major developers of generative AI, including Meta, to review the safeguards they have put in place and ensure the information rights of UK users are protected."

John Edwards on AI and emerging technology

The ICO will oversee emerging technologies that are built on large datasets. Indeed, a speech given by Commissioner John Edwards began by focusing on the phenomenal expansion of ChatGPT.

Edwards stated: "People were simultaneously amused by the novelty of it and unnerved by its power. Questions started being asked about where ChatGPT was getting its information from and the pros and cons of using personal data to train the model. Our colleagues in Italy, the Garante, banned ChatGPT due to concerns over how it used people's personal information.

"AI and emerging tech can be a massive force for good. The strides forward we've made in terms of healthcare, productivity, and transportation have been massive.

However, organizations that use these technologies must be transparent with their users about how their information will be processed. It's the only way we continue to reap the benefits of AI and emerging technologies. I said at the end of last year that 2024 cannot be the year that people lose trust in AI. I stand by that statement today.”

Edwards concluded: "Ever since the ICO's inception in 1984, data protection law has been the principal form of regulation for new technologies. The same principles apply now as they always have – you need to look after people's information, be transparent about how you're using it and ensure its accurate."

Enterprise Data Strategy (ICO25)

As the future of data privacy evolves, so too has the ICO. In 2022, the organization launched its Enterprise Data Strategy (ICO25) to ensure it would be ready as a regulator to manage the fast pace of technological change taking place as you read this.

The Commissioner states: "As a regulator, we're shifting our guidance away from 'don't do' to 'how to'. In a similar way, our data strategy is setting an ambitious vision to 'show, not tell'. We aspire to be an exemplar for responsible innovation in the use of data – one that can inspire and guide others through our own transformation."

Pregnancy and parenting club Bounty has been fined 400,000 for misusing customer data and sharing it with third parties without consent.

The company, which encourages new parents to sign up to exclusive offers shortly after giving birth apparently unlawfully shared the details of 14 million people.

According to the Information Commissioner's Office (ICO), Bounty collected member data using sign-up forms on its website, in-person as it circulated around UK maternity departments, and in merchandise pack claim cards.

However, the company also acted as a data broking service up until GDPR was introduced and shared the data supplied to it with other third parties. This is where the company failed to comply with the law and, as a result, has been fined for breaching the Data Protection Act 1998.

It was found to have shared information with credit reference and marketing agencies, including Acxiom, Equifax, Indicia and Sky without telling many of its users it planned to do so.

"The number of personal records and people affected in this case is unprecedented in the history of the ICO's investigations into data broking industry and organisations linked to this," said Steve Eckersley, ICO's Director of Investigations.

"Bounty were not open or transparent to the millions of people that their personal data may be passed on to such large number of organisations. Any consent given by these people was clearly not informed. Bounty's actions appear to have been motivated by financial gain, given that data sharing was an integral part of their business model at the time."

He added that sharing the data in such a way - and because of the nature of its business - Bounty has likely caused distress to many of its members. The data was revealed to include personal information, including details of their pregnancy status and children.

Bounty acknowledges the ICO's findings and said it didn't take a broad enough view of its responsibilities previously, according to Jim Kelleher, the company's managing director who posted a statement on its website.

"This was not of the standard expected of us. However, the ICO has recognised that these are historical issues. Our priority is to continue to provide a valuable service for new parents that is both helpful and trusted," he said.

"As the ICO has highlighted, we made significant changes to our processes in Spring 2018, reducing the number of personal records we retain and for how long we keep them, ending relationships with the small number of data brokerage companies with whom we previously worked and implementing robust GDPR training for our staff."

The company has now launched the Bounty Promise, which explains how the firm will respect the data it holds, only collect what's necessary, won't share data and that an independent data expert will check on its practices every year.

"Before Spring 2018, our data handling processes did not meet the standards that could be expected of us. We made a mistake for which we are sorry. As well as improving our processes in Spring 2018, we have now launched the Bounty Promise," the company said on Twitter.

The Information Commissioner's Office (ICO) has published its first strategy paper outlining how it will adapt its regulatory approach in light of new challenges presented by rapidly changing technology.

Among the key goals outlined in the paper, drafted to enhance the regulator's overall technical expertise and understanding, the ICO will educate staff on technological issues, and ensure businesses and the wider public are kept informed on new data protection risks.

The ICO also established, in its plans, three priority areas for 2018/19, including cyber security, AI, and web and cross device tracking. The data regulator will develop an action plan for each area which it plans to review and update annually.

The new three-year strategy is part of the ICO's wider efforts to strengthen its commitment to technology and innovation, which includes the appointment of Simon McDougall as the first executive director for technology policy and innovation.

McDougall, the former managing director of IBM-owned consultancy firm Promontory, is a "well-known international figure in the world of information rights," according to the ICO, and has also served on the board of a number of international bodies committed to upholding citizens' data and information rights.

"I am honoured to have the opportunity to join the ICO and lead their work in this critical area," McDougall said. "Technological change continues to accelerate, and it is vital that the ICO remains constructively and robustly engaged as organisations innovate in the use of personal data."

Also among the ICO's plans is the launch of a 'regulatory sandbox' in which organisations can develop innovative tools and services with assistance and guidance from the ICO. The regulator plans to consult on the implementation of this scheme later in 2018.

"Technology is driving changes to the societal, political, legal and business environment that the Information Commissioner's Office (ICO) needs to regulate," Information Commissioner Elizabeth Denham wrote in the foreword of the new strategy.

"The most significant data protection risks to individuals are now driven by the use of new technologies. The risks are broad - from cyber-attacks to the growth of artificial intelligence and machine learning."

"The GDPR contains new provisions to better regulate the risks arising from technology, including data protection by design and data protection impact assessments.

"These advances need not come at the expense of data protection and privacy rights - the ICO's approach to technology will be underpinned by the concept that privacy and innovation are not mutually exclusive."

The ICO has faced numerous challenges in the last few months in light of a massive data misuse scandal involving Facebook and the now-defunct Cambridge Analytica, which perhaps gave the regulator a taste of the issues it could expect to face in an increasingly-digitised landscape.

Its investigations into the misuse of personal data in political campaigns, which spans a vast number of organisations, led to Facebook last month being fined 500,000 - the maximum under the Data Protection Act 1998. The full results of the ICO's investigation are expected to be published by the end of the year.

The ICO has hit Nottingham County Council with a 70,000 fine for failing to safeguard its citizens' data, which led to anyone being able to view the information online.

The problem was exposed when a member of the public was able to read the data online stored in the council's Home Care Allocation System (HCAS) following a Google search. Nottingham County Council didn't implement any kind of security to stop people being able to access files, such as a login.

The data, which is thought to have been accessible for over five years, held details on whether disabled and elderly people were in hospital and included the gender, addresses, postcodes and care requirements of the individuals. The concern was that criminals could access the data and use the information to break into peoples' homes while they were away.

"This was a serious and prolonged breach of the law. For no good reason, the council overlooked the need to put robust measures in place to protect people's personal information, despite having the financial and staffing resources available," ICO Head of Enforcement Steve Eckersley said.

"Given the sensitive nature of the personal data and the vulnerability of the people involved, this was totally unacceptable and inexcusable. Organisations need to understand that they have to treat the security of data as seriously as they take the security of their premises or their finances."

The breach was first reported in June 2016, when it contained a directory of 81 service users and the data of more than 3,000 people. Not included in the data was the patients' names, although the ICO said it would be easy enough for people to find this information out from other sources if they wanted to.

The ICO has fined TalkTalk 100,000 for failing to protect consumer data from hackers in 2014, when personal details of 21,000 customers were leaked into the public domain.

The regulator said TalkTalk had breached the Data Protection Act because it didn't safeguard the huge amounts of data it held about its customers from staff. Employees were able to imporperly access the information, which was used by fraudsters to make scam calls to customers, using their names, addresses, phone numbers and account numbers.

The investigation revealed it was actually employees of Wipro, a third party company working with TalkTalk to resolve complaints about network coverage, that were able to access and swipe the data. The ICO found three Wipro accounts that had siphoned off the data, although 40 employees in total had access to the information.

"TalkTalk may consider themselves to be the victims here," Information Commissioner Elizabeth Denham said. "But the real victims are the 21,000 people whose information was open to abuse by the malicious actions of a small number of people. TalkTalk should have known better and they should have put their customers first."

The ICO said TalkTalk's actions breached the seventh principle of the Data Protection Act because it didn't have the appropriate technical or operational safeguards in place to prevent employees from accessing the confidential information. This is despite the company being aware of regulations surrounding data protection and having ample time to fix the flaws.

"This incident highlights why it is essential for companies to understand exactly how users are interacting with the network and data," Nir Polak, CEO at Exabeam. "Had TalkTalk had a means to monitor the activities of employees and third parties, its incident response team could have spotted the inappropriate access to customer data."

Measures TalkTalk could have taken to prevent employees accessing the data include ensuring the portal where the customer details were stored could only be accessed from authorised devices and preventing anyone from accessing or exporting the information via the portal.

"Big companies have been able to get away with lax security for years," said Jan van Vliet, Digital Guardian's vice president and general manager for EMEA. "Thankfully, with the GDPR now on the horizon, the days for such complacency really are numbered. These businesses can expect to swap a 100,000 fine for data protection breaches for one in the millions."

MoneySuperMarket has been slapped with an 80,000 fine for sending out millions of emails to customers who had previously opted out from being contacted.

The price comparison site was found to have sent 7.1 million emails to customers over the course of just 10 days, outlining changes to their terms of service, despite the fact that those customers had chosen not to receive email communication.

MoneySuperMarket sent the emails between 30 November and 10 December 2016, of which almost 6.8 million were successfully received by customers. Although it appeared to be in the guise of a terms of service change, UK data watchdog the Information Commissioner's Office (ICO) believed this was a misguided attempt to try and persuade users to sign up for marketing emails.

Part of the email included a section labelled "Preference Centre Update", which stated: "We hold an e-mail address for you which means we could be sending you personalised news, products and promotions. You've told us in the past you prefer not to receive these. If you'd like to reconsider, simply click the following link to start receiving our emails."

The ICO chastised the company for its actions, with head of enforcement Steve Eckersley describing the emails as "unacceptable" and a "circumvention of the rules".

"Organisations can't get around the law by sending direct marketing dressed up as legitimate updates," said Eckersley. "When people opt out of direct marketing, organisations must stop sending it, no questions asked, until such time as the consumer gives their consent. They don't get a chance to persuade people to change their minds."

"We will continue to take action against companies that choose to ignore the rules," he added.

A MoneySuperMarket spokesperson told IT Pro: "At MoneySuperMarket, we take the protection of our customers' data and privacy very seriously. We apologise unreservedly to the customers affected by this isolated incident and we have put measures in place to ensure it doesn't happen again."

The ICO also fined supermarket chain Morrisons 10,500 in June after the company sent 130,671 emails to customers holding a store card who had previously opted out of communication. The ICO said at the time that Morrisons had "ignored their decision", even though customers had explicitly told the company they did not want marketing emails.

An independent review panel has agreed there was a "lack of clarity" in the initial data-sharing DeepMind agreement with the Royal Free Hospital that saw 1.6 million people's data shared without their consent.

However, the panel said there was no evidence to suggest a breach of contractual obligations or data sharing agreements, unlike the UK data watchdog's Information Commissioner's Office (ICO), which deemed that the original deal was illegal.

The independent report, commissioned by DeepMind Health (DMH) following the ICO's own investigation that was published yesterday, expressed concerns that the specific scope of the original information sharing agreement with the Royal Free was not fully explained. However, it recognised that DMH has since taken steps to correct this.

An investigation by the ICO revealed several shortcomings in how the data was handled, particularly that patients were not adequately informed of how the data would be used. As a result, the authority believes the initial agreement broke data protection laws.

The panel, which was made up of a collection of industry leaders and academics, concluded that DMH acted only as a data processor, and that "any issues about data protection obligations or confidentiality obligations arising from the use of patient data during testing are in law, matters for the Royal Free as data controller, and we will not comment further on them".

While the report does not contradict the findings of the ICO, it said the specific shortcomings relating to the informing of patients lay squarely with the Royal Free, and that there was "no evidence that DMH had violated the data sharing agreement or any other contractual arrangements".

Under current laws, only the data controller is liable for breaches of regulations, however this will change with the new GDPR regulations set to come into force next year, as both the processor and controller will be jointly liable.

DMH has said it welcomes both the ICO investigation and the independent review, and acknowledges "we should have done more to engage with patients much earlier".

A number of other smaller criticisms were mentioned in the report, such as a handful of minor vulnerabilities in DMH's network and the logistics about "parachuting in" the Streams app, which relied on the huge volume of data to learn how to detect and diagnose acute kidney injury, but DeepMind said these have already been addressed.

DeepMind was also criticised for a lack of public engagement during the tests, as it failed to adequately refute claims spread in the media that patient data would be shared with its then-parent company, Google. If true, this would have breached contractual obligations, but there is "no evidence that DMH had any intention of doing this", according to the report.

The nine-person panel included Mike Bracken, CDO of the Co-operative Group and former CDO for the UK government, Eileen Burbidge, partner at investment firm Passion Capital, and Professor Donal O'Donoghue, medical director for Greater Manchester Academic Health Science Network.

03/07/2017:ICO: DeepMind-NHS deal broke data laws

The Royal Free NHS Foundation Trust failed to comply with data protection law when it provided patients' details to Google AI firm DeepMind, according to the Information Commissioner's Office (ICO).

As part of a trial to test an alert, diagnosis and detection system for acute kidney injury, the trust provided personal data of around 1.6 million patients to DeepMind back in September 2015, revealed seven months later by the New Scientist.

However, an investigation by the ICO discovered several shortcomings in how the data was handled, including that patients were not adequately informed that their data would be used as part of the test.

DeepMind had a deal with the Royal Free where the former would process partial patient records containing personally identifiable information (PII) held by the trust.

The PII in question included data on people who had presented for treatment in the previous five years for tests together with data from the trust's existing radiology electronic patient record system. Under the terms of the agreement, DeepMind would process approximately 1.6 million such partial records for clinical safety testing.

But Information Commissioner Elizabeth Denham determined that these records were processed for the purpose of clinical safety testing without patients being informed of this processing.

"The Commissioner was not satisfied that the Royal Free had properly evidenced a condition for processing that would otherwise remove the need to obtain the informed consent of the patients involved and our concerns in this regard remain," the ICO said in a letter to the trust.

It added that the mechanisms to inform those patients that their data would be used in the clinical safety testing of the Streams application were inadequate.

"In short, the evidence presented to date leads the Commissioner to conclude that data subjects were not adequately informed that the processing was taking place and that as result, the processing was neither fair nor transparent," said the ICO.

"Patients would not have reasonably expected their information to have been used in this way, and the trust could and should have been far more transparent with patients as to what was happening," Denham said in a statement.

"We've asked the trust to commit to making changes that will address those shortcomings, and their co-operation is welcome. The Data Protection Act is not a barrier to innovation, but it does need to be considered wherever people's data is being used."

The ICO won't fine the NHS trust or DeepMind. Instead, the trust has been asked to establish a proper legal basis under the Data Protection Act for the DeepMind project - which was and for any future trials, and to set out how it will comply with its duty of confidence to patients in any future trial involving personal data.

Plus, it mustcomplete a privacy impact assessment, including specific steps to ensure transparency, and commission an audit of the trial, the results of which will be shared with the Information Commissioner, and which the Commissioner will have the right to publish as she sees appropriate.

"We welcome the ICO's thoughtful resolution of this case, which we hope will guarantee the ongoing safe and legal handling of patient data for Streams," said DeepMind co-founder Mustafa Suleyman, and DeepMind Health clinical lead, Dominic King.

"In our determination to achieve quick impact when this work started in 2015, we underestimated the complexity of the NHS and of the rules around patient data, as well as the potential fears about a well-known tech company working in health," they added.

"We were almost exclusively focused on building tools that nurses and doctors wanted, and thought of our work as technology for clinicians rather than something that needed to be accountable to and shaped by patients, the public and the NHS as a whole. We got that wrong, and we need to do better."

The pair said DeepMind has published all NHS contracts since its "mistake" in failing to publicise the Streams contract, which it also replaced with "a far more comprehensive contract" in November 2016.

DeepMind said it's also since developed a patient and public engagement strategy, and is currently awaiting the published findings of nine "independent reviewers" it tasked with scrutinising DeepMind Health.

Gloucester City Council has been hit with a 100,000 fine after a hacker downloaded 30,000 emails containing employees' personal information.

In July 2014, a hacker "took advantage of a weakness in the council's website" to gain direct access to the council's mailboxes, which stored information on employee finances as well as internal communications.

The attack exploited the highly publicised 'Heartbleed' flaw, a vulnerability within the OpenSSL software library that allowed hackers to eavesdrop on web users, as well as steal usernames, passwords, documents, and in this case, emails.

Despite the bug becoming widely-publicised in the media, as well as in warnings issued by UK data watchdog the Information Commissioner's Office (ICO), the council knowingly failed to fix the vulnerabilities, according to the regulator.

Sally Anne Poole, group enforcement manager at the ICO, described the incident as a "serious oversight", adding that the council's security systems were not robust enough to protect the data they held.

"The attack happened when the organisation was outsourcing their IT systems. A lack of oversight of this outsourcing, along with inadequate security measures on sensitive emails, left them vulnerable to an attack," she said.

"Business and organisations must understand they need to do everything they can to keep people's personal information safe and that includes being extra vigilant during periods of change or uncertainty," added Poole.

Jon McGinty, managing director at the council, said in a statement to IT Pro that the penalty would have a "serious and detrimental" impact on the authority's finances, and is considering appealing the decision.

"The council takes the security of its data very seriously and remains of the view that it did take swift and reasonable steps in 2014 to prevent a data breach as soon as it was alerted to the existence of this hacking vulnerability and the availability of a security patch," said McGinty.

"The council did account for the risk of this potential fine in its accounts for 2016-17, but nevertheless, its payment will only result in money being taken away from the people of Gloucester and given to the Treasury," added McGinty.

Paul Farrington, manager at application security company Veracode, said that the council could have done more to protect its data.

"The latest fine imposed by the ICO is an unfortunate outcome for this public body. Vendors like Veracode in 2014 were offering free scans, with no strings attached. The council officials could have protected the 30,000 leaked email records without incurring any additional cost burden."

The flaw, which was first discovered in 2014, was famously used against advice forum Mumsnet, which saw hackers post messages purportedly from CEO Justine Roberts that derided users and claimed the site was up for sale.

The Information Commissioner's Office (ICO) has fined Basildon Council 150,000 for publishing online the personal data of a traveller family.

The authority breached the Data Protection Act by making publically available data on the family in a planning application.

The ICO discovered that the council received a written statement in support of a householder's planning application for proposed works in a green belt. The statement contained sensitive personal data relating to a static traveller family who had been living on the site for many years.

It referred to the family's disability requirements, including mental health issues, the names of all the family members, their ages and the location of their home. The council published the statement in full, without redacting the personal data, on its online planning portal later that day.

An investigation by the ICO found that the council failed to carry out data protection procedures and training. It was revealed that an inexperienced council officer didn't notice the personal information in the statement, and there was no procedure in place for a second person to check it before the personal data was inadvertently published online. The information was only removed on 4 September 2015 when the concerns came to light.

While the council had routinely redacted personal data from planning documents a practice also adopted by other local authorities Basildon subsequently argued it was not, in fact, allowed to do so under planning law. This was rejected by the ICO, which said planning regulations could not override people's fundamental privacy and data protection rights. It added that publication of planning documents online was a choice, not a legal requirement.

"This was a serious incident in which highly sensitive personal data, including medical information, was made publicly available," said ICO enforcement manager Sally Anne Poole.

"Planning applications in themselves can be controversial and emotive, so to include such sensitive information and leave it out there for all to see for several weeks is simply unacceptable."

"Data protection law is clear and planning regulations don't remove an individual's rights. Local authorities and, indeed, all organisations must be certain that their internal processes and procedures are robust and secure enough to ensure that people's sensitive personal information is protected," she added.

An impending overhaul of data protection law will present "opportunities and challenges" for companies as they prepare for the changes, which are one year away today.

The General Data Protection Regulation (GDPR) will hand EU citizens more control over how organisations use their personal data, and impose stringent rules on how organisations handle that data and what they can use it for.

In a discussion at TechUK's London headquarters today, Rob Luke, deputy information commissioner of the Information Commissioner's Office (ICO), said that organisations typically ask the UK data watchdog for granular guidance "often people will say to us: tell us what we need to do'".

He added that the ICO was "working at pace to produce detailed guidance, both at national level but also European level guidance produced by the Article 29 EU Working Party, to which we are making a major contribution".

Organisations should be proactive in gaining compliance, rather than adopt a reactive approach to their GDPR preparations, motivated solely by a mindset of compliance or risk management, the ICO contends.

"Those organisations which thrive under GDPR will be those who recognise that the key feature of GDPR is to put the individual at the heart of data protection law," says Luke.

"Thinking first about how people want their data handled and then using those principles to underpin how you go about preparing for GDPR means you won't go far wrong," he adds.

Luke believes that preparations for the forthcoming regulations boiled down to two words: "transparency" and "accountability".

"Being clear with individuals how their personal data is being used, and placing the highest standards of data protection at the heart of how you do business," Luke explains

GDPR, he believes, is a board-level issyue no matter the size of the company, not least because under GDPR the regulator "wields a bigger stick". For the most serious violations of the law, the ICO will have the power to fine companies up to 20million or 4%of a company's total annual worldwide turnover, whichever is larger.

But the cost to business of poor practice in this area goes above and beyond any fine the ICO could impose, Luke argues.

"Losing your consumers' trust could be terminal for your reputation and for your organisation," he says."A model where organisations take an approach to data protection which earns the trust of consumers in a more systematic way [is better]. And where that trust translates into competitive advantage for those who lead the charge."

Andrew Rogoyski, vice president of cyber security services at CGI UK, urges boards and CEOs to plan how their firms will achieve compliance, but doesn'tthink organisations could already be compliant with one year to go.

He warned that the regulations could "amplify potential share price movements as a result of a data breach" and therefore boards' and CEOs' attention is "crucial".

While GDPR is helpful now, he thought it would be different in a few years' time. "If you think about 2025 and automation there will be key differences in handling information and privacy."

David Erdos, a lecturer in law and the open society at Cambridge University, sees GDPR as a step up in terms of a rules-based approach. "The aim is harmonisation across Europe" but derogations from this will have an important impact," he says.

Erdos adds that he doesn't think the UK will move away from EU's fundamental values on data protection following Brexit.

Emma Butler, data protection officer at digital identity firm Yoti, says that adhering to GDPR regulations starts in the legal department but "actually it is [about] change management".

"GDPR is an opportunity to make sure you are doing information governance really well," she claims, adding that there are threats and risks coming from GDPR but these shouldn't be an organisation's sole focus.

Antony Walker, deputy CEO of TechUK, believes there are questions about whether the UK will continue to stay in step with evolving data policy discussions in Europe, adding that the ICO is "clearly very influential" but Brexit now "limits the amount of time available to consider how to implement GDPR in a UK context".

Picture credit: Rene Millman/IT Pro

The Information Commissioner's Office (ICO) has said it will begin a formal investigation to assess whether political groups were using analytics in a way that breached data protection laws.

The announcement follows an initial assessment in March, which looked at the use of analytics to shape political campaigning and contact people based on individual data. It appears that the ICO has gathered enough evidence of data protection violations to merit a full-blown investigation.

"Given the big data revolution, it is understandable that political campaigns are exploring the potential of advanced data analysis tools to help win votes," wrote information commissioner Elizabeth Denham, in a blog post.

"The public have the right to expect that this takes place in accordance with the law as it relates to data protection and electronic marketing," she added.

Political parties are able to contact members of the public to promote political agendas, however to do so falls under the category of 'direct marketing', which is subject to data protection laws. The ICO has responded to complaints in the past where individuals have received direct contact from political parties without their consent.

A recently published report by the Guardian revealed how political parties were targeting messages at voters through their Facebook pages, and tailoring the content based on individual data.

The use of analytics came under the spotlight in the aftermath of the Brexit vote, when it emerged that US-based Cambridge Analytica, which claims to be the"global leader in data-driven campaigning", was involved with the Vote Leave campaign. However this association was never declared to the election watchdog.

The ICO also said that although the use of data analytics by political parties is becoming more frequent, the level of awareness among the public about how their data is collected and shared remains low. "Having considered the evidence we have already gathered I have decided to open a formal investigation into the use of data analytics for political reasons," said Denham.

The investigation will run alongside current investigations into practices deployed during the EU referendum campaign, but could expand beyond that into similar political movements. This investigation will remain a "high priority" for the ICO, according to Denham.

"I am conscious that opening this formal investigation coincides with ongoing campaigning ahead of the General Election," said Denham. "The timing of my decision is unrelated to the current campaign, but I would nonetheless remind all relevant organisations of the need to comply with the law."

Jump to "What to do if you think you have been affected"

Latest News

27/04/2017: Two men have admitted their part in a hacking attempt on TalkTalk's website.

Matthew Hanley, 22, and Connor Allsopp, 20, pleaded guilty to charges relating to the massive data breach in October 2015.

The pair admitted their part in a plot to steal the personal details of thousands of customers, the Old Bailey heard. The pair from Tamworth, Staffordshire, will be sentenced in May.

The court heard how Hanley hacked into TalkTalk's website and obtained a spreadsheet containing TalkTalk customers' details.

Hanley also pleaded guilty yesterday to three offences under the Computer Misuse Act, including the hacking of the TalkTalk website, obtaining files that would enable the hacking of websites and supplying files to enable the hacking of websites to others.

Allsopp pleaded guilty on 30 March to assisting fraud and sharing a file that could help other hackers.

The Metropolitan Police identified Hanley as a suspect in their investigations and was arrested last October. Officers seized computers and devices from his address but found they had been wiped or the data encrypted so they couldn't access it.

Police then looked at Hanley's social media accounts and found conversations where Hanley had been discussing his involvement and actions in hacking into TalkTalk's website and discussing how he had deleted incriminating data from his computers and encrypted his devices to cover his tracks.

The online conversations also revealed that having stolen data from the telco, Hanley then got Allsopp to try and sell the personal data of customers so that the pair could profit from it.

Police arrested Allsopp this month and showed him these chat logs. Allsopp admitted that he had unsuccessfully tried to sell customer data that Hanley had stolen, as well as sell details of the vulnerabilities on TalkTalk's website that would enable others to hack into it.

Detective chief inspector Andy Gould, from the Met's Falcon Cyber Crime Unit, said that no matter how hard criminals try to conceal their activity, "they will leave some kind of trail behind".

"This investigation has been painstaking and the work our detectives have done to trace and identify those involved has combined cutting-edge digital forensic techniques, with old-fashioned detective work that has led to the conviction of several of those involved and the investigation continues," he added.

The pair are due to be sentenced on 31 May at the Old Bailey.

15/11/2016: A 17-year-old boy has admitted to seven charges of hacking, two of which relate to the TalkTalk data breach in October 2015.

The teenager, who cannot be named for legal reasons, pleaded guilty to all seven offences under the Computer Misuse Act at Norwich Youth Court today.

TalkTalk lost 60 million as a result of the hack, in which 157,000 customers had their details stolen, including bank account numbers, sort codes, and dates of birth.

UK data protection regulator the Information Commissioner's Office (ICO) fined the mobile operator a record 400,000 for the incident. Information Commissioner Elizabeth Denham said last month: "TalkTalk's failure to implement the most basic cyber security measures allowed hackers to penetrate TalkTalk's systems with ease."

The teenager will be sentenced on 13 December, after also targeting Manchester University Library and Cambridge University Library, among others. According to Sky News, he told the court: "I didn't really think of the consequences at the time. I was just showing off to my mates."

05/10/2016: TalkTalk has been issued with a record 400,000 fine by the Information Commissioner's Office (ICO) following the large-scale data breach in October 2015, due to "security failings".

The ICO's in-depth investigation found that the attack on the company last year could have been prevented if TalkTalk had taken basic steps to protect customers' information and that the firm allowed the cyber attacker to access customer data "with ease".

ICO investigators found that the cyber attack took advantage of technical weaknesses in TalkTalk's systems, allowing attackers to access the personal data of 156,959 customers including their names, addresses, dates of birth, phone numbers and email addresses. In 15,656 cases, the attacker also had access to bank account details and sort codes.

Information Commissioner Elizabeth Denham said: "TalkTalk's failure to implement the most basic cybersecurity measures allowed hackers to penetrate TalkTalk's systems with ease.

"Yes hacking is wrong, but that is not an excuse for companies to abdicate their security obligations. TalkTalk should and could have done more to safeguard its customer information. It did not and we have taken action."

The data was taken from an underlying customer database that was part of TalkTalk's acquisition of Tiscali's UK operations in 2009, and was accessed through an attack on three vulnerable webpages within the inherited infrastructure.

The ICO said TalkTalk failed to properly scan this infrastructure for possible threats and so was unaware the vulnerable pages existed or that they enabled access to a database that held customer information.

TalkTalk was also not aware that the installed version of the database software was outdated and was no longer supported by the provider.

A criminal investigation by the Metropolitan Police has been running separately to the ICO's investigation.

A TalkTalk spokesperson did not indicate if the telco will appeal the fine.

They said: "TalkTalk has cooperated fully with the ICO at all times and, whilst this is clearly a disappointing decision, we continue to be respectful of the important role the ICO plays in upholding the privacy of consumers.

"During a year in which government data showed nine in ten large UK businesses were successfully breached, the TalkTalk attack was notable for our decision to be open and honest with our customers from the outset. This gave them the best chance of protecting themselves and we remain firm that this was the right approach for them and for our business.

"As the case remains the subject of an ongoing criminal prosecution, we cannot comment further at this time."

20/07/2016: Around 9,000 TalkTalk customers left the provider in its latest quarter, as the operator continues to feel the aftereffects of last year's hack that spilt the data of 157,000 users.

Revenues declined 0.4 per cent year-on-year and TalkTalk also lost 23,000 TV customers.

However, it added 48,000 mobile users to its books and 36,000 fibre customers.

TalkTalk CEO Dido Harding said: "We are very pleased with how the year has begun. Revenue growth was level year on year despite a smaller customer base and churn was down year on year as we drove growth in mobile and fibre, and delivered real improvements in our customers' experience.

22/06/2016: TalkTalk's chief executive, Dido Harding, has earned 2.8 million in the last 12 months, despite the performance of the network being subject to a number of hacks and staff's bonuses being cut substantially.

This is almost triple the amount Harding was paid in the previous 12 months and has caused some controversy within the company.

Around 2 million of the Baroness's pay relates to a long-term incentive scheme linked to the company's performance over the last three years, according to The Financial Times, despite profits having declined by 50 per cent over the course of the year.

However, Harding has said that the 220,000 bonus she was supposed to be paid for the last year's performance will be donated instead to the Ambitious About Autism charity, rather than her receiving it. The reason for this, she said, is because the company caused such strife to those involved in the operator's hack in October.

TalkTalk said it would be cutting bonuses of the company's senior staff from 62 per cent to 40 per cent due to profits reducing as a direct result of the hack. It is estimated the slip up will cost TalkTalk 60 million to rectify.

12/05/2016: Customers have forgiven TalkTalk for last year's devastating cyber attack, CEO Dido Harding claimed today, despite profits halving and 100,000 users jumping ship.

The telecoms provider, which released its annual financial report today, was adamant that customers are positive about the company, despite losing thousands of customers' data last October.

Harding said: "The vast majority of customers believe we looked after them. The business bounced back strongly in the final quarter following the cyber attack in October."

She added that the number of customers leaving has been the lowest ever in the last three months, saying this is "testimony to the speed with which customer sentiment towards TalkTalk has recovered", and that "trust in the brand and brand consideration [are] both higher than they were before the attack".

However, the report also revealed that the company lost more than 100,000 customers and had to spend over 40 million as a direct result of the attack, which slashed its annual profits by more than half.

TalkTalk's customer loss only amounts to around three per cent of its total customer base. While this is a substantial loss for a major business, Cable.co.uk telecoms expert Dan Howdle believes that it should have been substantially higher.

"TalkTalk suffered three major security breaches in 2015, something savvy customers should not easily forgive," he said. "That TalkTalk lost only three per cent of its existing customer base, however, points to problems... with the switching process itself."

He pointed out the fact that while the company dished out unconditional free upgrades to its customers in response to the attack, it did not allow unhappy customers to freely leave their contracts.

"Clearly the situation needs improvement. If a provider fails in its remit to protect its customers and their data there should be a free get-out clause. There isn't, and that has allowed TalkTalk to limit the damage the attack caused it," he concluded.

15/04/2016: Over 125,000 customers have abandoned TalkTalk's broadband services during the first four months of this year.

It is estimated that around 17 per cent of their customers are considering leaving their broadband services as well, according to The Register.

TalkTalk has continued to lose broadband customers, but has gained an overall increase of business partly due to lowered prices and promotional offers.

Thus far TalkTalk has had a strong first quarter, with 40 per cent of their new customers choosing to subscribe to their services due to competitive pricing. The company's "triple play" service also yielded an increase of 3.2 per cent, raising their total market share for the category to 12.2 per cent.

BT remains the most dominant provider, having captured nearly one third of the market (31.5 per cent) in competition with other service providers. Their closest competitor, Sky, having recently lost 5 per cent of their market share, now holds 23.3 per cent of the market.

This progress shows that the company is gaining forward momentum since they were hacked, which compromised personal data of over 150,000 customers. The incident ran up a bill of around 60m and a loss of over 100,000 customers.

17/03/2016: TalkTalk is swapping passwords for voice biometrics following the cyber attack that affected 157,000 of its customers.

The mobile operator will let users access their accounts via voice recognition, rather than requesting their passwords or answers to pre-set questions, which may have been compromised by hackers.

Nuance, the company providing TalkTalk with the voice recognition technology, said its software compares a customer's voice to their unique voiceprint and securely authenticates the customer - or flags the call if fraud is suspected.

TalkTalk claimed it is the first mobile operator to introduce the technology, doing so after the cyber attack it suffered cost the firm an estimated 60 million, as well as 100,000 customers leaving the firm.

The banking industry already uses voice recognition, with HSBC most recently deciding to replace passwords with biometrics, also supplied by Nuance.

02/02/2016: TalkTalk has revealed last year's cyber attack cost the company 60 million, almost double an initial estimate.

A trading update on Tuesday revealed that the hack had cost far more than the estimated 35 million, though TalkTalk also experienced revenue growth of 1.8 per cent in Q3, with earnings expected to reach 255 million - 265 millon by the end of the year.

Dido Harding, TalkTalk CEO, said: "It is encouraging to see the business returning to normal after a challenging quarter that was dominated by the cyber attack. Our customers have responded well, with almost half a million customers choosing to take up our unconditional offer of a free uprade.

"Both churn and new connections recovered during December and January and independent external research has revealed that customers believe that we acted in their best interest. In fact trust in the TalkTalk brand has improved since just after the attack and consideration is higher now than it was before the incident."

28/01/2016: Police have arrested three people at one of TalkTalk's Indian call centres on suspicion of stealing customers' data, sparking further questions about the care with which the telecoms company treats its customer records.

The men were arrested by the Indian authorities in connection with the stolen data, which they allegedly used to make scam calls from a call centre in Kolkata, according to a Channel 4 investigation.

In response, TalkTalk said it is working with international outsourcer Wipro, which runs the call centre, and local police.

The mobile provider said in a statement: "Acting on information supplied by TalkTalk, the local police have arrested three individuals who have breached our policies and the terms of our contract with Wipro. We are also reviewing our relationship with Wipro."

It added: "We are determined to identify and deal effectively with these issues and we will continue to devote significant resource to keeping our customers' data safe. Data theft and scams are a growing issue affecting all businesses and they are notoriously difficult to investigate and prosecute. We are pleased that our investigations have yielded results, and will continue to do everything we can to tackle these crimes."

The incident is only the latest data breach TalkTalk has suffered, and it comes hot on the heels of an attack last October in which 157,000 customers had their details stolen, including bank account numbers, sort codes, and dates of birth.

Information commissioner Christopher Graham told MPs this week that companies needed to strengthen their security to prevent similar data losses, the Financial Times reported.

The Information Commissioner's Office (ICO) is investigating the TalkTalk data breach as part of the Cyber security: Protection of personal data online inquiry.

21/01/2016: Customers are leaving TalkTalk in their droves after the mobile operator's data hack last year, research from Kantar Worldpanel ComTech shows.

Seven per cent of TalkTalk's broadband base switched to a different provider in the fourth quarter of 2015, Kantar's figures show.

The research firm said there was "no doubt" that the company lost potential customers as a result of its data hack.

Almost a fifth of those leaving TalkTalk did so as a direct result of poor reliability a four per cent increase on the previous quarter, when fewer than one per cent cited this reason.

Imran Choudhary, consumer insight director at Kantar Worldpanel, said: "TalkTalk continues to offer some of the most attractive promotions across the home services market and almost a third of its new customers did choose it for this reason, but there can be no doubt that it lost potential customers following the major data hack.

"If it's to recover from recent events TalkTalk will need to offer more than just good value."

The telecoms firm's systems were breached last October, and 157,000 customers had their details stolen, which included bank account numbers, sort codes, and dates of birth.

The hack has already cost the company 35 million in one-off costs to resolve the immediate backlash related to 15,600 of those leaked bank details.

TalkTalk chief executive Dido Harding talked down the long-term repercussions for the brand at the time, saying: "Customers think we're doing the right things".

BT benefitted from the exodus, with 12 per cent of its new customers saying their primary reason for joining was because they saw it as a trusted supplier. That figure was twice the market average.

16/12/2015: Police recommended that TalkTalk stayed quiet about attacks on its site while detectives carried out their investigations and made arrests.

At a House of Commons Culture, Media and Sports Committee, CEO Dido Harding told MPs that the cyber attack was "one of the most difficult periods for the TalkTalk board and for me personally".

"It was clear by lunchtime on Thursday (22 October) that the sensible thing to do to protect my customers was to warn all of them because I could help make them safer. I could give them free credit monitoring, I could warn them not to accept these scam calls," she told committee members.

"For completely understandable reasons, the advice we received that Thursday afternoon from the Metropolitan Police was not to tell our customers."

She said she opposed the idea of compensation claims being valid and added she was "not aware of anyone who has directly lost money as a direct consequence of the attack. Any who have suffered a direct financial loss should get in direct contact. We wish to deal with on a case-by-case basis."

Harding added that the Telecoms Ombudsman "is there to adjudicate, and customers not getting fair redress from their insurance company, bank, or telco, should go there."

In reply to questions over who was responsible, Harding said that no one individual in the firm was.

"It really does come back to the CEO and board. Was there sufficient oversight in terms of the security policies, the resourcing of the technology team to implement those policies, and the knowledge and understanding of best practice?

"It is a board level issue, not an individual issue below."

25/11/2015: An 18-year-old boy was arrested in Llanelli, Wales, over the TalkTalk data hack yesterday.

The teenager becomes the fifth person detained in relation to the cybercrime incident and was arrested on suspicion of blackmail, and taken into custody at a Dyfed Powys police station.

The four others arrested a 16-year-old boy from Norwich, on suspicion of offences under the Computer Misuse Act, a 20-year-old man from Staffordshire, a 16-year-old boy from Feltham and a 15-year-old from County Antrim, Ireland, all subsequently bailed.

A total 157,000 customers had data stolen in October's cyber attack, TalkTalk has confirmed, with cybercriminals making off with 21,000 bank account numbers and sort codes, along with 28,000 obscured credit and debit card details and 15,000 dates of birth.

20/11/2015: A law firm is considering legal action against TalkTalk on behalf of customers whose data was lost in the mobile operator's latest leak.

Hugh James law firm, based in Cardiff, told the Guardian it has been approached by victims of the data breach and is encouraging others to come forward to join a possible group legal action against the company.

Partner Gwen Evans said: "Since the serious security breach occurred last month, we have been approached by a number of TalkTalk customers who are naturally concerned about whether their personal data has been accessed and misused.

"We are considering whether there is a case to take group legal action against TalkTalk because it is highly likely that the Data Protection Act 1998 will have been breached during this time."

A total 157,000 customers had personal data stolen in the October attack, TalkTalk has confirmed.

Cybercriminals also made off with 21,000 bank account numbers and sort codes, along with 28,000 obscured credit and debit card details and 15,000 dates of birth.

16/11/2015:

Writing in the Guardian, professor of the public understanding of technology, John Naughton, said the mobile operator's board must take more responsibility for customer security, saying that the company's failure to encrypt users' data cannot be blamed solely on engineers.

"Companies like TalkTalk are up against professional criminals," he wrote. "They, therefore, need to up their amateurish game. If a company's business requires it to store customers' sensitive information, then data security has to be a board-level responsibility, up there with health and safety and regulatory compliance. It is not just a matter for techies and boffins."

He added: "There have to be serious criminal and civil penalties for carelessness, complacency or incompetence.

11/11/2015: TalkTalk's cyber attack will cost it between 30 million and 35 million, it has admitted.

Despite just 160,000 customers losing personal data in last month's hack, shares in the mobile operator have dropped by a quarter since news of the incident went public.

But it blamed one-off costs like the loss of online sales for the predicted dip in earnings, and CEO Dido Harding today announced a string of free offers to customers who have stayed with the firm as a way of thanking them.

Customers can choose a selection of free features, including extra TV channels, a mobile SIM with free texts, data and calls, and unlimited landline and mobile calls from 1 December.

Meanwhile, TalkTalk has announced a new bundle of online and telephone security features, such as F-Secure's anti-virus protection, web filter HomeSafe, and the ability to block cold callers.

Harding said: "TalkTalk takes the security of customers' data extremely seriously and we are taking significant further steps to ensure our systems are protected, as well as writing to all our customers outlining what we are doing to keep their data safe. "In recognition of the unavoidable uncertainty, and because we know that doing what is right for our customers will ensure the best possible outcome for the company over the longer term, we are today announcing the offer of a choice of free upgraded services to all our customers."

06/11/2015: Only 156,959 TalkTalk customers had any personal data stolen in the hack on its systems, the mobile network has claimed - far fewer than the 1.2 million originally feared. Of those, roughly 10 per cent had their bank account number and sort code stolen, about 5,000 fewer than stated last week.

"Ongoing forensic analysis of the site confirms that the scale of the attack was much more limited than initially suspected, and we can confirm only four per cent of TalkTalk customers have any sensitive personal data at risk. However, we continue to advise customers to be vigilant, and to take all precautions possible to protect themselves from scam phone calls and emails," the company said in an updated statement.

TalkTalk said it has now contacted all customers whose financial details were accessed and will be contacting all other affected customers over the next few days.

The company also claimed that "the financial information accessed cannot on its own lead to financial loss", however, stories of defrauded customers abound, including one man who was offered just 30 as a "goodwill gesture" after 3,500 was stolen from his bank account in the wake of the hack.

04/11/2015: Police have arrested a fourth person in connection with the TalkTalk data hack, this time a 16-year-old boy from Norwich.

The teenager was detained by police yesterday on suspicion of offences under the Computer Misuse Act after the National Crime Agency and the Met's Cyber Crime Unit obtained a warrant to search an address in the city.

The boy has been released on bail until late March 2016, after a 20-year-old man was arrested in Staffordshire in connection with the cybercrime incident, and bailed until early March.

Two other boys a 16-year-old from Feltham and a 15-year-old from County Antrim, Northern Ireland have also been arrested and bailed in connection with the attack.

More than a million customers were affected by the hack, TalkTalk has confirmed, while 21,000 bank account numbers and sort codes were stolen.

03/11/2015: TalkTalk customer data is being sold on the dark web for as little as 20p per record, according to reports.

An LBC investigation claimed it found 2,500 customer accounts on the dark web and used a sample of the data from the criminals selling it to contact victims of the hack, including a woman called Louisa Jenkins.

She told the Nick Ferrari Breakfast show: "I'm quite angry. It feels like your details are never safe."

The news comes days after a Sunday People investigation that found a criminal calling himself Martian claimed to sell TalkTalk data on a dark website called Alpha Bay for 1.62 a time, offering information in bulk.

02/11/2015: Hackers stole 1.2 million customers' email addresses, names and phone numbers in the TalkTalk data breach, the company has confirmed.

However, the cybercriminals only made off with 21,000 bank account numbers and sort codes, along with 28,000 obscured credit and debit card details and 15,000 dates of birth, the mobile operator said in a statement on its website.

With speculation over just how many of its four million customers were affected by the attack last month, TalkTalk said, "the extent of the data accessed is significantly less than originally suspected".

CEO Dido Harding said: "Today we can confirm that the scale of the attack was much smaller than we originally suspected, but this does not take away from how seriously we take what has happened and our investigation is still ongoing.

"On behalf of everyone at TalkTalk, I would like to apologise to all of our customers. We know that we need to work hard to earn back your trust and everyone here is committed to doing that."

Credit and debit card information, which was missing the middle six digits at the time that hackers accessed it, cannot be used to make financial transactions.

TalkTalk has shared the bank details of affected customers with their banks to help prevent fraud and has partnered with credit check company Noddle to offer customers a free year of credit monitoring alerts.

The Metropolitan Police Cyber Crime Unit's criminal investigation is ongoing.

Detective Superintendent Jayne Snelgrove said: "TalkTalk have done everything right in bringing this matter to our attention as soon as possible. Our success relies on businesses being open with us and each other about the threats they encounter."

02/11/2015:

He was taken into custody by Staffordshire police on suspicion of offences under the Computer Misuse Act and is the third person held in connection with the case after one 15-year-old boy from Northern Ireland and one 16-year-old boy from west London were arrested and subsequently bailed last week.

The 16-year-old has been bailed until a date as yet to be revealed by police while the 15-year-old from Northern Ireland is on bail until later this month.

30/10/2015: Police have arrested a second teenage boy in connection with the TalkTalk hack, this time, a 16-year-old from West London.

The boy was arrested on suspicion of Computer Misuse Act offences, reports BBC News, but has since been bailed. This follows the arrest of a 15-year-old boy from Northern Ireland, who was arrested earlier in the week.

A property in Liverpool has also been searched, according to the Metropolitan Police.

27/10/2015: TalkTalk has announced it will still charge customers affected by the TalkTalk hack a fee if they want to discontinue their service and cancel their contract.

However, it will waive termination charges if a customer can prove they have had money stolen from their bank accounts, although it denies this is a likely scenario because neither bank details nor credit card information was stolen in the attack.

"In the unlikely event that money is stolen from a customer's bank account as a direct result of the cyber-attack [rather than as a result of any other information given out by a customer], then as a gesture of goodwill, on a case-by-case basis, we will waive termination fees," it said in a statement.

Also this morning, the Police Service of Northern Ireland revealed the 15-year-old arrested last night in County Antrim in relation to the hack has been released on police bail pending further enquiries.

However, Jonathan Craig, a member of the Policing Board in Northern Ireland, told the Belfast Telegraph that should the boy be found to be implicated in the attack it "raises questions" for TalkTalk as to how a teenager from County Antrim could have breached a major telecoms provider.

26/10/2015: Labour accused the government of chaos and incompetence over its response to the TalkTalk data breach today, as reports emerged of a 15-year-old boy's arrest in connection with the attack.

Shadow minister for culture and the digital economy Chi Onwurah questioned her Tory counterpart Ed Vaizey over Whitehall's data policy, claiming it has failed to keep up with cybercriminals' endeavour.

Speaking in the House of Commons today, Onwurah said: "This government's data policy is chaos illuminated by occasional flashes of incompetence. Will the minister acknowledge that all the innovation has come from the criminals while the government sit on their hands, leaving it to businesses and consumers to suffer the consequences?"

Her comments came hours before Scotland Yard confirmed a 15-year-old boy had been arrested on suspicion of Computer Misuse Act offences.

The Police Service of Northern Ireland and the Met's cybercrime unit arrested the teenager in County Antrim at 4.20pm today and have taken him into custody.

The hack has led to victims' bank accounts being emptied by cybercriminals, with millions believed to have had their personal details leaked after TalkTalk admitted it had not encrypted customer data.

Vaizey failed to confirm whether or not police would receive more resources to respond to the hacking case and its victims after Onwurah questioned how the government would help police.

Instead, he replied: "The police have extensive resources with which to combat cybercrime, and we are the government who set up the national cybercrime unit.

"We have invested more than 860 million in cyber-security and we have a number of very effective schemes with which to engage business."

TalkTalk reported the breach to UK data watchdog the Information Commissioner's Office on Thursday, Vaizey added, a day after the breach took place.

However, he refused to reveal how many customers TalkTalk believe have been affected by the breach it is thought to be in the millions, but the figure remains unconfirmed.

25/10/2015: TalkTalk has admitted it did not encrypt customer data such as credit card details and telephone numbers after hackers stole potentially millions of customers' information.

CEO Dido Harding told the Sunday Times today: "It wasn't encrypted, nor are you legally required to encrypt it.

"We have complied with all of our legal obligations in terms of storing of financial information."

The mobile operator has four million users but has not confirmed how many it believes were caught up in the data breach it suffered earlier this week.

However, TalkTalk could face thousands of legal claims from victims, with the total payout rising to around 20 million, according to insurance law firm BLM, including the cost of replacing four million credit cards.

Partner and head of technology Tim Smith told the Financial Times: "[It is] quite probable that customers will sue for a breach of the Data Protection Act and a breach of confidence and privacy rights."

Meanwhile, an 80,000 ransom note received by Harding from someone claiming responsibility for the hack included a table of 400,000 TalkTalk customers who have recently undergone credit checks with the company, KrebsOnSecurity reported.

It comes after the Times claimed yesterday that victims' bank accounts had been emptied by hackers, adding that TalkTalk had ignored criticism of its online security a year ago.

23/10/2015 3pm: TalkTalk's CEO has received a ransom note purportedly from the hackers responsible for a huge data hack that could affect millions of customers.

Dido Harding told BBC News: "It is hard for me to give you very much detail, but yes, we have been contacted by, I don't know whether it is an individual or a group, purporting to be the hacker.

"All I can say is that I had personally received a contact from someone purporting - as I say I don't know whether they are or are not - to be the hacker looking for money."

The email will be examined by the Metropolitan Police, which is investigating the hack.

It is not yet clear how many customers' data has been lost in the leak, but TalkTalk has four million users and the information lost includes names, addresses, dates of birth, telephone numbers and credit card details not all of this was encrypted.

The mobile operator lost the data in the middle of a distributed denial of service (DDoS) attack, during which its servers crashed under huge volumes of traffic.

It is believed hackers may have used the DDoS attack to distract TalkTalk's security team while they pinched the data.

The mobile operator has recommended people change their passwords as soon as its site goes back online, and this latest breach is the third in 12 months to hit the company.

What could happen to customers?

Christopher Boyd, malware intelligence analyst at Malwarebytes, said hackers could target customers with phishing attacks now they have their details.

"People should be paying close attention to emails and other communication which appear to be genuine at first glance," said Boyd.

"If those messages are asking for additional information, service sign-ups or providing refund request attachments they should think very carefully before proceeding, lest they fall victim to a malware attack or yet another incident of data theft."

IT security company ESET warned that criminals will also use the data to steal customers' identities.

Security specialist Mark James said: "The data of all their customers will almost certainly be used for potential identity theft along with the obligatory attempts at financial access with any current information they may have attained.

"There was some partial' encryption of credit card numbers, we are led to believe, but businesses need to understand that all our private data has a value, not just the direct financial stuff."

The consequences for TalkTalk

The Information Commissioner's Office (ICO) has been notified of the breach and will investigate it, potentially leading to a fine of up to 500,000 for TalkTalk.

But Mahisha Rupan, senior associate at law firm Kemp Little, said TalkTalk's swift notification to customers of the breach could mitigate any such penalty.

"The ICO is likely to take into account TalkTalk's response to the breach and its attempt to limit any losses incurred by the customer," said Rupan.

ESET's James added that TalkTalk should bolster its security following the attack, saying: "Companies should implement proper use of cryptography, encrypting the sensitive data and hashing the passwords in a cryptographically sound way. We are forced to trust companies with our data and so often that trust is lost through no fault of our own."

23/10/2015 10am: TalkTalk has confirmed that hackers have once again infiltrated its website in what the company has called a "sustained" cyber attack that took place on Wednesday this week.

It is not known just how many of the firm's four million customers have been affected but hackers are believed to have been able to gain access to a wide range of sensitive information including names, addresses, dates of birth, email addresses, telephone numbers and other TalkTalk-specific account data.

Perhaps more concerning for TalkTalk customers is the fact that credit card or bank details have also been exposed as the company confirmed that such information may be among the data hackers had access to during the cyber hack.

Yesterday, the comms giant announced that the Metropolitan Police had launched a full criminal investigation into the issue, in addition to issuing an apology to customers, which started with the words no customer wants to hear: "We're very sorry..."

"We are continuing to work with leading cyber crime specialists and the Metropolitan Police to establish exactly what happened and the extent of any information accessed," TaklTalk's managing director (consumer) Tristia Harrison said in a statement issued online.

TalkTalk said it had taken measures to secure the website after the hack and that it constantly reviews its system security to protect data and prevent subsequent attacks. However, many users will take convincing as this is not the first time TalkTalk has suffered a data breach. Back in February this year (see story below), the company confirmed hackers had stolen personal user information and were targeting customers with scam phone calls.

"We would like to reassure you that we take any threat to the security of our customers' data very seriously," Harrison's statement continued.

"...Unfortunately, cyber criminals are becoming increasingly sophisticated and attacks against companies which do business online are becoming more frequent."

The incident has been reported to the ICO and TalkTalk has contained major banks to keep them on high alert for suspicious activity on customer accounts. It has also recommended that customers monitor their own accounts for any unauthorised or unusual activity and to also check their credit reports held with the main agencies Call Credit, Experian and Equifax.

TalkTalk has also addressed frequently asked questions related to the attack online to help customers better understand what has happened and how they might be affected.

In response to the question 'Why were you targeted?' the company has responded: "Unfortunately TalkTalk is by no means an isolated incident. Barely a week goes by now without cybercriminals using increasingly hostile and sophisticated methods to target companies that do business online. It's not just companies like TalkTalk that are being targeted, banks, retailers like Apple and even the US Government have been victims."

27/2/15: TalkTalk has confirmed hackers accessed its systems and stole personal information about its customers, resulting in some receiving follow-up phone calls from scammers.

In a statement issued to IT Pro, TalkTalk confirmed a small number of its four million customers had their account names and numbers compromised.

"We are aware of a small but nonetheless significant, number of customers who have been directly targeted by these criminals and we have been supporting them directly," the firm said in a statement.

"We want to reassure customers that no sensitive information like bank account details has been illegally accessed, and TalkTalk Business customers are not affected."

TalkTalk confirmed the Information Commissioner's Office, which is responsible for enforcing the Data Protection Act, has been made aware of the breach.

The data theft came to light following an uptick in reports from customers about receiving suspicious-sounding phone calls from individuals claiming to work for TalkTalk at the end of 2014, TalkTalk said in an email to customers.

"In a small number of cases, customers told us that the criminals were quoting their TalkTalk account number, as well as their phone number," it states.

"Following further investigation into these reports, we have not become aware that some of the information we have about some customers their name, home address, phone number and TalkTalk account number could have been illegally accessed in violation of our security procedure.

"Please rest assured that your sensitive information of date of birth, bank or credit card details have not been illegally accessed," it adds.

The email then goes on to reiterate that TalkTalk will never take its customers banking details over the phone or ask them to download any kind of software onto their computers.

"Preventing all scam and nuisance calls is a high priority for us. We are doing everything possible to prevent this from happening again, and to protect you from all malicious and nuisance calls.

"In some cases we are able to block certain callers, including those from these criminal organisations, from ringing customers on our network, if they've breached a strict set of criteria.

"You can also block your number from receiving unsolicited sales calls by registering with the Telephone Preference Service," the email concludes.

What to do if you have been affected by the TalkTalk hack

Advice from Wim Remes, Rapid7

"We often hear the question "What can users of a compromised service do?" - If you suspect that personal data is compromised, there are several steps you can take. These are actually the same steps you should consider in order to minimise the impact of a compromise:

• If you have used the same password as for the compromised service anywhere else, change the passwords for all those services. Consider configuring two-factor authentication if the service supports it.
• If your bank allows this, restrict the amount of money that can be transferred without additional authorisation to the lowest possible amount that keeps it practical for you.
• Never perform actions in relation to your bank account or customer record based on a phone call you receive from a self-proclaimed representative of your bank or service provider. It is your right to request additional identification and phone calls, while direct, are never used as a last resort before your account is blocked.
• Watch your bank statements closely and do not keep all money in your current account, just enough to cover expenses/bills for the next 30 days or whatever time period works for you.
• Keep track of all your online accounts and manage them as if they constitute the contracts they are related to. If an online account is not strictly necessary, consider to cancel it in order to limit your data footprint as much as possible."

This article was originally published on 27/02/15 and has since been updated numerous times as new facts emerge, most recently on 16/12/2015.

UK information commissioner Elizabeth Denham has made her first speech after taking on the role, announcing her commitment to transforming the UK's data privacy laws, suggesting an EU-like policy needs to be put in place.

She explained research by the ICO revealed only one in four Brits trust UK businesses with their data and the primary aim of her five years in office is to change that, building a culture of data trust in the country.

"At the end of my five year term my wish is that we are at a place where citizens and consumers have much more confidence in organisations' use of personal data," she said. "I want that survey figure of one in four to go up."

This will be done by transforming the UK's data and protection policies, aligning them with the EU's mission. It will be a "progressive regulatory regime that stands up to scrutiny, that doesn't leave the UK open to having rocks thrown at it by other regimes. And that has consistency and adequacy with the Europe."

Europe's new privacy laws, which come into effect in 2018, will come down harder on businesses that don't comply with the regulations, including hefty fines - up to 4% of a company's annual turnover.

Although Denham didn't reveal whether such fines would be imposed on UK companies should they not meet the guidelines, she suggested such action was necessary in order to protect the UK trade and UK citizens.

"The fact is, no matter what the future legal relationship between the UK and Europe, personal information will need to flow," she explained. "It is fundamental to the digital economy. In a global economy we need consistency of law and standards the GDPR is a strong law, and once we are out of Europe, we will still need to be deemed adequate or essentially equivalent."

Denham added that she's currently in talks with ministers and senior officials in government to help it come up with a fair set of policies that should be transformational rather than negatively affecting business.

"Legislative change does bring nervousness, but it also brings opportunity. These changes stronger data protection law and enforcement are aimed at inspiring public trust and confidence," she concluded.

The Information Commissioner's Office (ICO) will investigate WhatsApp's decision to share users' data with Facebook, it has confirmed.

Elizabeth Denham, the new information commissioner, said she plans to "pull back the curtain" on exactly how people's data is being shared between the two firms, following yesterday's announcement.

WhatsApp will let businesses chat to users on its platform for the first time in the next few months, but also changed its terms and conditions to allow it to pass users' information onto its parent company Facebook, which bought it for 11.2 billion in 2014.

The UK's data watchdog said there may be nothing wrong with the decision to share data, but that it has a responsibility to check.

Denham said in a statement: "The changes WhatsApp and Facebook are making will affect a lot of people. Some might consider it'll give them a better service, others may be concerned by the lack of control.

"Our role is to pull back the curtain on things like this, ensuring that companies are being transparent with the public about how their personal data is being shared, and protecting consumers by making sure the law is being followed.

"We've been informed of the changes. Organisations do not need to get prior approval from the ICO to change their approaches, but they do need to stay within data protection laws. We are looking into this."

WhatsApp believes that by sharing data with Facebook, the social network can serve better adverts to users, as well as allowing the chat platform "to do things like track basic metrics about how often people use our services and better fight spam on WhatsApp".

Donald Trump's Aberdeenshire golf resort will not be investigated or prosecuted, despite failing to register with the Information Commissioner's Office under the Data Protection Act.

Every company that handles personal information is required by law to register under the DPA, but Trump International Golf Links Scotland, established in 2012, failed to do so until Thursday, the ICO told IT Pro.

The hotel and golf course complex has now registered under the act, and the data privacy watchdog says that it has no intentions of prosecuting the organisation for its four-year lapse.

"Where data controllers respond to advice from the ICO that they need to notify and complete the registration process," a spokesperson said, "it generally would not be a proportionate response to then commence a prosecution.

"We treat those that we regulate in a consistent way and to pursue the golf course in these circumstances would be inconsistent to how we have dealt with others in similar circumstances."

However, an ICO spokesman pointed out to IT Pro that just because an organisation is registered under the Data Protection Act does not mean that it is automatically compliant with it. Trump's resort could still find itself in hot water if it does not take adequate steps to ensure the security of its' customers' data.

The company, which claims to have hosted tens of thousands of guests, told The Guardian that the lack of registration was a "clerical oversight".

"We take the security of our employees and guests' personal data very seriously," a statement read, "and comply with all aspects of the Data Protection Act."

The new Information Commissioner believes the UK can navigate Brexit to successfully update its data protection laws.

Elizabeth Denham, who joined the Information Commissioner's Office (ICO) from an equivalent position in British Columbia last month, gave a bright assessment of the future of Britain's data protection, despite the vote to leave the EU causing uncertainty.

In her first newsletter for the UK's data watchdog, Denham wrote: "The result of the EU referendum and its impact on data protection reforms will undoubtedly create uncertainty, as any period of flux does. It's clear to me though that the UK is well equipped to navigate the changes ahead successfully.

"Data protection is a team sport. Effective regulation requires engagement with the public sector, with industry, with civil society and with the public at large."

Her comments come after the minister for data protection admitted Brexit has created doubt over whether the UK will need to formulate its own laws instead of adopting the EU's General Data Protection Regulation, which comes into force in May 2018.

Baroness Lucy Neville-Rolfe said: "Currently it seems unlikely we will know the answer to these questions before the withdrawal negotiations get under way."

It is widely accepted the UK will need to prove it provides an adequate level of data protection if EU data is transferred here.

Denham's tenure itself was in doubt when it emerged that the government had failed to get the Queen's consent for her appointment in time.

But now in the post, she indicated that she plans to engage with stakeholders about the future of data protection regulation, saying: "Data protection is a team sport. Effective regulation requires engagement with the public sector, with industry, with civil society and with the public at large.

"We all have an important role to play in this, and I look forward to the opportunity to work with you during my time here."

Elizabeth Denham has started in her new role of Information Commissioner this week, taking over from previous head of the ICO, Christopher Graham.

Denham's term will include the period running up to and the aftermath of the UK's exit from the European Union, presenting a number of challenges, including whether to adopt the General Data Protection Regulation to help the UK's trade with other European countries or to come up with a new set of rules and regulations.

Other challenges include helping the ICO decide how to deal with data thieves in the UK, whether this is by giving judges more powers or new legislation that would pass the responsibility onto another official body.

"I am delighted to have taken up this position and am excited about the challenges ahead. I look forward to working with staff and stakeholders to promote openness by public bodies and data privacy for individuals," Denham said in a statement.

Elizabeth Denham has been working in data protection and regulation for the last 12 years. The Canadian previously held similar positions in her native country and since 2010 she has been the Commissioner at the Office of the Information and Privacy Commissioner for British Columbia.

Her previous achievements include launching an investigation into the way Facebook handles privacy, which led to some changes to the way the company uses data. She will be paid 140,000 in her new role, which will last for five years as a minimum term.

Between Graham's departure in June and yesterday, Deputy Commissioner Simon Entwisle stood in as Information Commissioner.

Her appointment was announced back in April, when Jesse Norman, chair of the committee said: "The committee noted with interest Ms Denham's views on a range of topics, including the possible retention of emails as official records, the extension of FoI and directors' liability for data breaches, in particular."

"We also noted Ms Denham's track record on data protection with government in British Columbia, and her proactive approach to protection of privacy with major international technology companies," Normal continued.