Search Privacy Fines

British Airways (BA) fined £20m for failing to protect the personal and financial details of more than 400,000 of its customers.

Marriott International Inc fined £18.4million for failing to keep millions of customers’ personal data secure. Marriott estimates that 339 million guest records worldwide were affected following a cyber-attack in 2014 on Starwood Hotels and Resorts Worldwide Inc. The attack, from an unknown source, remained undetected until September 2018, by which time the company had been acquired by Marriott.

The Information Commissioner’s Office (ICO) has issued a £12,700,000 fine to TikTok Information Technologies UK Limited and TikTok Inc (TikTok) for a number of breaches of data protection law, including failing to use children’s personal data lawfully.

ICO fines facial recognition database company Clearview AI Inc £7.5m and orders UK data to be deleted

Between 18 March 2019 and 1 December 2020 Interserve Limited (“Interserve”) failed to process personal data in a manner that ensured appropriate security of the personal data using appropriate technical and organisational measures as required by Article 5(1)(f) and Article 32 GDPR. This rendered Interserve vulnerable to a cyber-attack which took place in the period 30 March 2020 to 2 May 2020 and affected the personal data of up to 113,000 employees of Interserve.

The Information Commissioner’s Office (ICO) has fined Advanced Computer Software Group Ltd (Advanced) £3.07m for security failings that put the personal information of 79,404 people at risk.? Advanced provides IT and software services to organisations, including the NHS and other healthcare providers, and processes people’s personal information on behalf of these organisations.? The fine relates to a ransomware incident in August 2022. Hackers accessed certain systems of Advanced’s health and care subsidiary via a customer account that did not have multi-factor authentication (MFA). The cyber attack was widely reported at the time, with reports of disruption to critical services such as NHS 111, and other healthcare staff unable to access patient records.

The ICO found that the company failed to put appropriate security measures in place to prevent a cyber-attack on a chat-bot installed on its online payment page. The data breach, which included names, payment card numbers, expiry dates and CVV numbers, potentially affected 9.4million of Ticketmaster’s customers across Europe including 1.5million in the UK

Easylife Limited has contravened Article 5(1)(a) of the GDPR in that there were serious deficiencies in the way it has collected, processed, and used the personal and special category data of 145,400 individuals.

The Police Service of Northern Ireland has been fined £750,000 for infringing Articles 5(1)(f), 32(1) and (2) of the UK GDPR between 25 May 2018 and 14 June 2024.

Data Controller(s) fined for serious breaches of the first and seventh data protection principles in respect of the processing of the personal data of ‘UK Users’.

CRDNN Limited fined with the maximum £500,000 fine for making more than 193 million automated nuisance calls.

The Information Commissioner’s Office (ICO) has fined DSG Retail Limited (DSG) £500,000 after a ‘point of sale’ computer system was compromised as a result of a cyber-attack, affecting at least 14 million people.

Cathay Pacific Airways Limited £500,000 for failing to protect the security of its customers’ personal data. Between October 2014 and May 2018 Cathay Pacific’s computer systems lacked appropriate security measures which led to customers’ personal details being exposed.

Carphone Warehouse fined £400,000 after serious failures placed customer and employee data at risk.

A company behind 99.5 million nuisance calls has been fined a record £400,000 by the Information Commissioner’s Office (ICO).

Uber fined for failing to protect customers’ personal information during a cyber attack.

Miss-Sold Products UK Ltd fined £350,000 after they failed to ensure that marketing calls sent to individuals who had consented to receive marketing.

Your Money Rights Ltd. Made unsolicited automated marketing calls without consent of recipients