Who was sanctioned, and for what?

In an insurance tender in 2024 worth around 200 million CZK, the ministry had parts of the tender documents drawn up by a broker who could later receive commissions from the winning insurer. As the contracting authority took no measures against the conflict of interest, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed a final fine of 300,000 CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Other

Legal basis

Gesetz über die Vergabe öffentlicher Aufträge (Pflicht zur Vermeidung von Interessenkonflikten)

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Published

15 Sep 2026

Original amount 300,000 CZK, converted at the ECB reference rate of 15 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Employees

10,000 or more

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The UK Information Commissioner's Office (ICO) issued a reprimand to ACRO Criminal Records Office. According to the ICO, it followed a cyber incident that may have affected the personal data of around 10,000 people in the UK. The ICO found infringements of the duty to implement appropriate technical and organisational security measures under Article 32 UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

From 2020 to April 2026, on the basis of old long-term logging contracts, the state forestry group supplied six wood processors with guaranteed quantities of roundwood outside public auctions, while all others could only buy through auctions. In its first decision on the competitive neutrality of public undertakings, the Konkurences padome (Latvian Competition Council) imposed 7,859,606.89 EUR and required equal sales conditions for all qualified bidders.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law

Legal basis

Art. 14.1 Konkurences likums (Wettbewerbsneutralität)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

According to the authority, the ministry met its breach notification and communication obligations.

Checked against the official source on 28 Sep 2026 · Direct link

The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Data Protection Act 2018, Section 40

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Culpability

negligent

Published

5 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

In September 2022 the public TVET college mistakenly emailed reports verifying the qualifications and criminal records of three employees to other staff, informed neither the regulator nor those affected, and had not registered an information officer. Departing from the view of its Enforcement Committee, the regulator also treated this as impermissible further processing and found breaches of accountability, purpose limitation, security safeguards and the notification duty; on 22 May 2026 it ordered, among other things, registration, notification of the breach, a written apology, a compliance framework and POPIA training for all staff.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Sections 8, 15(1), 19(1) und 22(1) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA

Action

Order

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The college recalled the email two days later, informed staff of the error and took action against those responsible; according to the regulator, this did not relieve it of the duty to notify.

Published

2 Jun 2026

Checked against the official source on 4 Oct 2026 · Direct link

Since 2020, the Canada Revenue Agency (CRA) has experienced more than 42,000 individual breaches in which unauthorised persons accessed tax accounts or changed data in order to redirect benefits. In a special report to Parliament, the Privacy Commissioner of Canada criticised, among other things, the delayed introduction of mandatory MFA and incomplete incident recording, and made nine recommendations, eight of which were accepted in full and one in part.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act (Kanada)

Action

Other

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

7 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Cardiff University was fined £280,000 and ordered to pay £11,745 in costs after two employees developed occupational asthma from exposure to animal allergens. According to the Health and Safety Executive, the university failed from 2008 to 2025 to identify and implement suitable controls against allergen exposure, although the COSHH regulations and relevant guidance had long been in place.

Authority / court

Cardiff Magistrates' Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 2(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

Guilty plea.

Published

1 May 2026

Original amount 280,000 GBP, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

In December 2024 the Kolding City Court fined the Region Syddanmark (Region of Southern Denmark) 1,000,000 DKK for two breaches of the duty to ensure appropriate data security. On 23 March 2026 the Vestre Landsret (Western High Court) upheld only the first charge – in a research and clinical database, logged-in users could access PDF documents of more than 23,000 registered persons, including health data of minors in psychiatric care, by changing the URL – and reduced the fine to 500,000 DKK; it acquitted the region of the charge concerning patient data in a presentation on its website.

Authority / court

Retten i Kolding; Vestre Landsret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, Art. 83 Abs. 4 lit. a und Abs. 9 DSGVO; databeskyttelseslovens § 41 stk. 1 nr. 1, stk. 3 og 6

Action

Fine

Status of proceedings

reduced

Sector

Public sector

Culpability

negligent

Repeat case

yes

Original amount 500,000 DKK, converted at the ECB reference rate of 23 Mar 2026.

Checked against the official source on 28 Sep 2026 · Direct link

In June and July 2020 contractors of the state-owned forestry corporation felled six giant trees and three hollow-bearing trees in Wild Cattle Creek State Forest near Coffs Harbour that should have been retained under the Coastal Integrated Forestry Operation Approval. On the EPA’s prosecution, the Land and Environment Court convicted the corporation and found harm to koala habitat and cultural harm to the Gumbaynggirr people; following a restorative justice conference, the AUD 450,000 penalty goes to the Yurruungga Aboriginal Corporation for remediation projects. The corporation must also commission an independent audit of its procedures and publish the conviction.

Authority / court

NSW Environment Protection Authority (EPA NSW) / Land and Environment Court of NSW

Area of law

Environment and sustainability · Emissions and permits

Legal basis

Coastal Integrated Forestry Operation Approval (NSW)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Repeat case

yes

Published

16 Mar 2026

Original amount 450,000 AUD, converted at the ECB reference rate of 16 Mar 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Ten municipalities (Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal and Zoetermeer) had received, stored and used analyses of the local Islamic community prepared by an external research firm (mostly so-called power-field analyses, in Haarlemmermeer a quick scan), which also contained information on the religion and other sensitive characteristics of individuals. On 3 February 2026 the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed 25,000 EUR on each board in separate decisions (250,000 EUR in total); for seven municipalities it also restricted further processing of the analyses to handling data subject rights and court proceedings.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 6 Abs. 1 und Art. 9 Abs. 1 DSGVO (AVG); Verarbeitungsbeschränkung nach Art. 58 Abs. 2 DSGVO (sieben Bescheide)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

5 Feb 2026

Checked against the official source on 2 Oct 2026 · Direct link

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

29 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

During a public order training exercise in February 2021, police officers wearing flame-retardant protective clothing had petrol bombs thrown at them; four officers suffered burns with permanent scarring. There was no information on the service life and testing of the PPE, no risk assessment for the manufacture and use of the petrol bombs, and no safe systems of work. The Health and Safety Executive (HSE) prosecution resulted in a fine of 60,000 GBP plus 9,470 GBP in costs.

Authority / court

Health and Safety Executive (Sheffield Magistrates' Court)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Health and Safety at Work etc. Act 1974, s. 2(1)

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

20 Jan 2026

Original amount 60,000 GBP, converted at the ECB reference rate of 19 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In June 2023, a lamp post dating from the 1950s/60s, whose steel at the base was at least 60 % rusted through, fell over and seriously injured a pedestrian. The post had been rated as poor in 2022 but was not scheduled for replacement until 2024; the council's visual inspections did not identify the acute risk of collapse. The Health and Safety Executive (HSE) prosecution resulted in a fine of 80,000 GBP.

Authority / court

Health and Safety Executive (Glasgow Sheriff Court)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Health and Safety at Work etc. Act 1974, s. 3(1)

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

12 Jan 2026

Original amount 80,000 GBP, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

In 2021, a hacker gained access via a web form to a web server and a database server of the university, obtained, among other things, names with passwords and citizen service numbers of students and staff, and unsuccessfully demanded a ransom. According to the Dutch data protection authority (Autoriteit Persoonsgegevens, AP), security was not aligned with the risks, and the rights of a database account were not restricted.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Mitigating circumstances

Settlement without objection; active damage limitation, strengthened resilience and sharing of lessons learned with other organisations.

Published

17 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Between 2018 and 2020 the university notified twelve personal data breaches, six of which involved unauthorised persons gaining access to staff email accounts through phishing and in some cases setting up forwarding rules. The DPC found infringements of Art. 5(1)(f), 30(1), 32(1), 33(1) and 34(1) GDPR, issued a reprimand and imposed fines of €45,000, €3,000, €35,000 and €15,000, totalling €98,000.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 30(1), 32(1), 33(1), 34(1) DSGVO; ss. 110–111 Data Protection Act 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The university accepted most of the findings, acknowledged responsibility and improved its systems, training and policies; the fines are well below those in the draft and no remedial order was made.

Checked against the official source on 2 Oct 2026 · Direct link

The municipality had processed personal information of a former employee which was exposed on the internet; the Information Regulator treated this as a gross violation of privacy and issued an enforcement notice. Because the municipality did not implement the corrective instructions, an administrative fine of ZAR 500,000 followed; as it did not pay, the Regulator has initiated court proceedings to recover the amount.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Nov 2025

Original amount 500,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5, 6, 12, 13, 35, 88

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The Slovak Whistleblower Protection Office again fined the Ministry of Interior, this time 70,000 EUR. From the end of August 2024 the ministry had issued personnel orders, without the Office's consent, against five protected whistleblowers in the police service, transferring them and removing them from their posts. The President of the Office dismissed the appeal on 24 November 2025.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

§ 7 Abs. 1, § 19 Abs. 3 Zákon č. 54/2019 Z. z. (Hinweisgeberschutzgesetz)

Action

Fine

Status of proceedings

final

Sector

Public sector

Repeat case

yes

Liability of senior managers

The fine was imposed on the body as employer.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO issued an enforcement notice to South Wales Police over serious delays in handling subject access requests. The ICO found that from April 2023 to March 2024 the force answered only 29% of requests on time; in August 2025, 352 requests were overdue, one of them by almost two years. The ICO ordered the force to clear the backlog by June 2026. The legal basis is Articles 12(3), 15(1) and 15(3) UK GDPR and section 45 of the Data Protection Act 2018. According to the notice, the force employs almost 3,000 police officers and over 2,200 other staff.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 45 DPA 2018; section 149 DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Single Resolution Board (SRB) passed on pseudonymised comments from former Banco Popular shareholders to Deloitte without informing the data subjects; the European Data Protection Supervisor (EDPS) considered this an infringement of the duty to inform. The Court of Justice of the European Union (Case C-413/23 P) set aside the judgment of the General Court and clarified that the duty to inform is to be assessed from the controller's perspective at the time of collection; the case was referred back to the General Court.

Authority / court

Gerichtshof der Europäischen Union, Rs. C-413/23 P

Area of law

Data protection · Data subject rights and transparency

Legal basis

Verordnung (EU) 2018/1725 (Informationspflicht)

Status of proceedings

under appeal

Sector

Public sector

Published

4 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued an enforcement notice to Bristol City Council because it found that the council had not responded to subject access requests as required by law. The notice relies on Articles 12(3), 15(1) and 15(3) UK GDPR and examines, among other things, the period from 1 April 2023 to 31 March 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 149 DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The state land fund examined a report from September 2022 only after 128 days and, until November 2024, did not sufficiently inform employees about the reporting procedure, protection options and the responsible person. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 6,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakei)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

§ 10 Abs. 5 und 8, § 19 Gesetz Nr. 54/2019 über den Schutz von Hinweisgebern

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Culpability

negligent

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

For months, the central authority failed to perform the tasks of the reporting office for three centres for children and families under its authority and did not make the responsible person known to employees. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 5,000 EUR; the appeal decision of 12 September 2025 reworded the operative part but left the fine at 5,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 3 und 5, § 19 Abs. 3

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

For registration for the Public Services Card, the ministry created biometric facial templates of a large part of the population without a sufficiently clear legal basis, with deficient information and an incomplete data protection impact assessment. Ireland's Data Protection Commission (DPC) issued a reprimand, imposed 550,000 EUR and ordered the biometric processing to be stopped within nine months if no valid legal basis is found.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und e, Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 Abs. 7 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

No deficiencies were found in the technical and organisational security measures.

Published

12 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

During mowing work in the municipal Parc des Sorbiers in July 2024, at least one nest of the protected bobolink was destroyed; a citizen reported the find. The city pleaded guilty under the Species at Risk Act and is paying 30,000 CAD.

Authority / court

Court of Québec (Anklage: Environment and Climate Change Canada)

Area of law

Environment and sustainability

Legal basis

Species at Risk Act, s. 33

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

12 Jun 2025

Original amount 30,000 CAD, converted at the ECB reference rate of 12 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to South Yorkshire Police. The ICO found that during a data transfer in July 2023, carried out by a third-party supplier within the digital evidence management system, 96,174 original body-worn video recordings were accidentally deleted. The ICO found that the force lacked appropriate technical and organisational security measures and could not demonstrate compliance. The action was based on the law-enforcement processing rules in Part 3 of the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

section 34(3) und section 40 DPA 2018 (Part 3)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the London Borough of Hammersmith and Fulham. The ICO found that, in answering a Freedom of Information request, the council released a spreadsheet that contained hidden data. This exposed personal data of 6,528 people, 2,342 of them children. The ICO criticised inadequate security measures and a failure to demonstrate compliance.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 5(2), 24(1), 32(1)(b) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the Chief Constable of Greater Manchester Police. The ICO found that, because of a persistent backlog of historic requests, the force repeatedly failed to answer subject access requests on time. The ICO found infringements of both the UK GDPR and the law-enforcement provisions of the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) und Art. 15 UK GDPR; section 45 und section 54 DPA 2018 (Part 3); Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The museum published no information on the protection options or on the external reporting channel and could not prove that employees were familiar with the internal reporting rules – there were no signature lists and no proof of intranet access. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 7,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 5, § 19 Abs. 3

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to the Chief Constable of Greater Manchester Police. The ICO found that CCTV footage from a police station custody suite in 2021, which was to be retained because of serious allegations against officers, was not checked for completeness when it was preserved and was partly lost. In addition, the individual concerned did not receive their data on time after a subject access request. The action was based on the law-enforcement processing rules in the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

section 45(3)(a) und (b) DPA 2018; sechster Datenschutzgrundsatz (section 40 DPA 2018, Part 3)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The municipality did not publish any information on the protection available to whistleblowers and at times had two valid, contradictory sets of rules on the internal reporting procedure online without stating which applied. The Office imposed a fine of 200 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 5, § 19 Abs. 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to Glasgow City Council. The ICO found that between April 2023 and March 2024 the council answered only 45% of subject access requests within the statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the City of Edinburgh Council. The ICO found that in 2023 the council failed to answer 40% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

An employee accidentally attached an Excel file containing data of 29,636 clients, including health data, to an e-mail sent to 292 clients. The Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found that measures to prevent data leakage had not been sufficiently tested and that the employee had not been involved in data classification and had been insufficiently instructed; fine of 9,000 EUR. Date = publication; source: archived copy.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 24 Abs. 1, Art. 32 Abs. 1 lit. b und d DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

21 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

Through a port between the internal and external networks that had been opened for convenience, attackers entered the e-litigation server of the National Court Administration and took 1,014 GB of case documents; the 4.7 GB that were recovered contained data on 17,998 people, including resident registration numbers. The authority criticised unencrypted documents, unchanged, easily guessed initial passwords on administrator accounts, missing security software on one server and a report only in December 2023, although there had been indications of the leak since April 2023. It imposed a penalty surcharge of 207,000,000 KRW and an administrative fine of 6,000,000 KRW (213,000,000 KRW in total), recommended disciplinary action and improvements and is publishing the imposition of the administrative fine on its website for one year.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 24(3), Art. 24-2(2), Art. 29, Art. 34(1) und (3); Sanktion nach Art. 34-2 a. F.

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Culpability

negligent

Mitigating circumstances

After an increase of 20%, the amount was reduced by 25%, taking into account protective efforts such as an ISMS certification (2020–2023).

Liability of senior managers

Measures against individuals are not set out here.

Published

9 Jan 2025

Original amount 213,000,000 KRW, converted at the ECB reference rate of 8 Jan 2025.

Checked against the official source on 4 Oct 2026 · Direct link

At least 1,000 former employees retained access after leaving to the KMD Nexus specialist system containing data on around 30,000 citizens; one former employee viewed 1,022 citizen records. In addition, an unauthorised person used an employee's login credentials for Office services containing information on around 5,000 people – both systems had been accessible from the internet for years without multi-factor authentication. The Danish data protection authority (Datatilsynet) reported the municipality to the police and proposed a fine of 350,000 to 400,000 DKK; the case is still pending before the courts, and no fine has been imposed so far.

Authority / court

Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 32

Action

Other

Status of proceedings

unknown

Sector

Public sector

Published

27 Nov 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Nationaal Archief (Dutch National Archives) planned to publish the archive of the post-war special jurisdiction (CABR), with some 485,000 files on suspected collaboration, online and full-text searchable for everyone from January 2025. Because, in the AP's assessment, this would have disclosed special category and criminal data of people still alive without any statutory exemption, the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) issued a formal warning to the Minister of Education, Culture and Science as controller.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection

Legal basis

DSGVO (AVG), insbesondere Art. 9 und 10; förmliche Warnung vor einer voraussichtlich rechtswidrigen Verarbeitung

Action

Reprimand or warning

Status of proceedings

final

Sector

Public sector

Published

6 Dec 2024

Checked against the official source on 2 Oct 2026 · Direct link

After candidate lists for the 2024 elections were released without authorisation, the Information Regulator found inadequate organisational safeguards and issued an enforcement notice on 10 September 2024. Because the Electoral Commission did not demonstrate compliance within the deadline (31 days), an infringement notice with an administrative fine of ZAR 100,000 followed.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Nov 2024

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Instead of designating its own responsible person, the body subordinate to the Ministry of Foreign Affairs, with at least 50 employees, had named the ministry’s secretary general and had not published the reporting channels in a way accessible to all employees. The Office imposed 2,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 1 und 5, § 19 Abs. 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Following a break-in into the district administration’s servers in which data were encrypted, services failed and social benefits were delayed. The Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found insufficient malware protection, deficient management of rights and passwords, a lack of recovery and insufficient information of data subjects and imposed 9,000 EUR. Date = publication; source: archived copy.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 lit. b, c und d, Art. 34 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

18 Oct 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to Southend-on-Sea City Council. The ICO found that in a Freedom of Information response published on a public platform in May 2023, a spreadsheet contained hidden personal data of current and former staff, including contact, pay and health details. The error was only noticed months later. The ICO found a breach of the requirement for appropriate data security.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In its response to a freedom of information request, a UK police service published an Excel file whose hidden worksheet contained the surnames, initials, rank and role of all its employees. The file was visible for just over two hours and was deleted after almost three hours; the police service assumed that it had fallen into the hands of militant groups.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

1,000 to 9,999

Culpability

negligent

Mitigating circumstances

Application of the public sector approach; without it, the fine would have been £5.6 million.

Published

3 Oct 2024

Original amount 750,000 GBP, converted at the ECB reference rate of 26 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Sep 2026 · Direct link

The ANPD issued two reprimands to a Brazilian federal ministry because, through a vulnerability in an application programming interface of its access and permissions system, personal data such as name, date of birth, mother's name and address could be retrieved when valid CPF numbers were queried: one for inadequately informing data subjects about the security incident (Art. 48 LGPD) and one for insufficient security of the systems (Art. 49 LGPD). Corrective measures were attached, including correcting the notice on the website regarding data categories, risks and the reasons for the delayed information, and a timetable for technical measures; the Board of Directors rejected the appeal in December 2025 and confirmed the final implementation deadline of 31 December 2025 set by the enforcement unit.

Authority / court

Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 48 und 49 Lei nº 13.709/2018 (LGPD); Art. 55 § 2 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)

Action

Reprimand or warning

Status of proceedings

final

Sector

Public sector

Published

9 Aug 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 9 Aug 2026 · Direct link

The ICO issued a reprimand to an academy in Essex with around 1,200 pupils aged 11 to 18. According to the ICO's findings, the school introduced facial recognition for cashless catering in March 2023 without first carrying out the required data protection impact assessment, which was only completed in November 2023. Until then it assumed consent unless parents had opted their children out, which in the ICO's view is not valid consent, and it did not seek advice from its data protection officer. The reprimand is based on an infringement of Article 35(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 35(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 Jul 2026 · Direct link

On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link

The Slovak Whistleblower Protection Office fined a ministry of the Slovak Republic 90,000 EUR. In October and November 2023 the ministry issued personnel orders against protected whistleblowers in the police service without the statutory consent of the Office, ten persons in the first-instance decision, such as temporary suspensions from service, transfers and removals from senior posts. The President of the Office upheld the fine in full on 23 October 2024 and discontinued the proceedings only for one individual act.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

§ 7 Abs. 1, § 19 Abs. 3 Zákon č. 54/2019 Z. z. (Hinweisgeberschutzgesetz)

Action

Fine

Status of proceedings

final

Sector

Public sector

Liability of senior managers

The fine was imposed on the body as employer.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 24 Jun 2026 · Direct link

Following a system change, both parents with custody gained access to letters from the municipal dental care service and automatically received letters containing, in some cases, protected addresses of the children – without any check as to whether the disclosure was permissible. The Danish Data Protection Agency (Datatilsynet) criticised the lack of change management; the municipality accepted a fine notice of 200,000 DKK.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32

Action

Fine

Status of proceedings

final

Sector

Public sector

Original amount 200,000 DKK, converted at the ECB reference rate of 27 May 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 May 2026 · Direct link

The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link

The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) examined on its own initiative a digital security monitoring system (including video surveillance and drones) and an access control system using fingerprints in reception and closed controlled facilities for third-country nationals. In a 2024 decision it imposed EUR 100,000 because no complete data protection impact assessment and no data protection by design were in place before procurement and deployment, and EUR 75,000 for unclear, incomplete and contradictory information and missing documents provided to the authority. The ministry must also achieve GDPR compliance within three months.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 25, 31, 35, 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Company name anonymised since 2 Apr 2026 · Direct link

After a ransomware attack in August 2023 on the technology park company, which is wholly owned by the Hong Kong government, data of 13,632 individuals were affected; data samples appeared on the dark web. On 2 April 2024 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of the data security duty (DPP 4(1)) and the retention limit (DPP 2(2)): brute-force attacks went undetected, remote access ran without multi-factor authentication, security audits were insufficient, the security policy lacked specificity, and data of 5,292 unsuccessful job applicants and former employees had been kept beyond the retention period. By enforcement notice, the company must among other things introduce multi-factor authentication, commission independent security audits every year and delete data held beyond the retention periods.

Authority / court

Privacy Commissioner for Personal Data (PCPD), Hongkong

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data (Privacy) Ordinance (Cap. 486), Data Protection Principles 4(1) und 2(2); Enforcement Notice nach s. 50(1)

Action

Order

Status of proceedings

unknown

Sector

Public sector

Published

2 Apr 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 2 Apr 2026 · Direct link

The ICO issued a reprimand to a children's services company owned by an English city council but operating independently of it. According to the ICO's findings, on 10 November 2022 the trust sent a family a child protection plan that wrongly included information about another person, including a child's data and criminal offence data. Among other things, the ICO criticised the trust for being unable to show clear, role-specific procedures or policies explaining how staff in the department concerned should apply data protection in practice. It found infringements of Articles 5(1)(f), 32(1)(b) and 32(2) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1)(b) und 32(2) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Mar 2026 · Direct link

The ICO issued a reprimand to the body that oversees policing in London. According to the ICO's findings, a permissions error at its processor between 11 and 14 November 2022 made two web forms public, including a form for contacting the London Victims' Commissioner. Only on 23 February 2023 did a member of the public tell the body that users could view every query submitted through the form; 394 people were later notified. According to the ICO, there is no evidence that the data was ever accessed. The ICO found infringements of Articles 5(1)(f) and 32(1) UK GDPR. The published document is partly worded as a provisional decision ("provisionally decided"); the ICO lists the reprimand as issued on its case page and confirmed it in a press release of 14 March 2024. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 13 Mar 2026 · Direct link

The ICO issued a reprimand to the chief constable of an English police force. According to the ICO's findings, in February 2021 an officer photographed a person's identity document on her personal mobile phone and uploaded the image to a messaging app group used by several UK police forces and international law enforcement agencies to tackle vehicle crime; the person was not told about this. The ICO was concerned that the sustained use of the group went unnoticed by supervisors, which it saw as a sign of a lack of data protection awareness. It found an infringement of section 40 DPA 2018 (the security principle for law enforcement processing). The reprimand is dated 5 March 2024; the ICO case page lists the case under 15 March 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 40 DPA 2018; Verwarnung nach Art. 58(2)(b) UK GDPR/Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Mar 2026 · Direct link