The Information Commissioner’s Office (ICO) has for the first time used new powers to punish companies that break laws protecting consumers’ data. British Airways and the Marriott hotel chain were the first firms targeted by the watchdog, which handed them fines totalling almost £300m.
Why has the ICO started handing out such huge fines?
In May last year, the powers of the ICO, along with its counterparts across Europe, were bolstered significantly with the introduction of the General Data Protection Regulation (GDPR). The much tougher EU-wide regulation surrounding the use consumer data, a necessary upgrade of weaker national data protection laws for the internet age, came with greatly enhanced powers to levy fines.
How much can the ICO fine a company?
To ensure companies take the new data protection rules seriously, GDPR gives data regulators the power to fine up to €20m (£18m), or 4% of annual global turnover, whichever is greater. The sum depends on the severity of the GDPR breach and factors including the level of cooperation of the company involved. For example, British Airways, which cooperated with the ICO investigation, was fined 1.5% of its global turnover. If the ICO had sought the maximum fine of 4% of BA’s total revenue, the bill could have been £489m.
Can companies fight the ICO?
The ICO is using its first two investigations under GDPR to make an example of British Airways and Marriott, providing a cautionary tale for others. Companies are allowed to appeal against the scale of the fines – British Airways and Marriott said they will put up a vigorous defence and have 28 days to make representations – and the ICO could reduce the final amount.
The regulator has a maximum of 16 weeks, from issuing the notice of a proposed fine to delivering its final verdict.
Where does the money go?
Fines received by the ICO go back to the Treasury. However, the ICO is exploring options, including ringfencing part of the fine income to cover potential litigation costs to defend its decisions.
How much tougher are the fines under the new GDPR legislation?
A lot tougher. Last year Facebook was fined £500,000 by the ICO over the Cambridge Analytica scandal, which involved the data of up to 87 million users improperly being shared with third-party developers without sufficient consent. At the time the ICO lamented the fact that this was the maximum fine it was allowed to impose under the old legislation.
Given Facebook’s worldwide revenue was $40.7bn (£31.5bn) in 2017, the ICO pointed out it could have handed down a fine of up to £1.26bn (4% of revenue) had the case had been eligible under GDPR.
The ICO has in the past been viewed as understaffed and underpowered. Has this changed?
It certainly has. The ICO’s role has become critical in the digital age. Its annual report, published this week, said last year was record-breaking for issuing monetary penalties, although these only totalled £3m in the 12 months to the end of March.
Average staff numbers have increased by a third – from 480 to 638 year-on-year – in line with its increased GDPR powers. It has 722 permanent staff. This pushed the ICO’s annual running costs up by 58%, from £27m to £43m.
Data protection complaints have almost doubled year-on-year from 21,019 to 41,661. The pay of the information commissioner, Elizabeth Denham, has risen by a quarter year-on-year from about £195,000 to about £245,000.
