UK ICO announces ability to retain up to £7.5m of monetary penalties

| Author: Secretariat | Filed under: General News
UK ICO announces ability to retain up to £7.5m of monetary penalties

On 14 June 2022, the UK Information Commissioner's Office ("ICO") announced that it had reached a fine income retention agreement with its sponsor department the Department for Digital, Culture, Media & Sport (DCMS) and the Treasury (HMT). Pursuant to the agreement, the ICO is now able to retain up to £7.5 million of funds paid as a result of its civil monetary penalties per annum. The funds will be audited and are to cover "pre-agreed, specific and externally audited litigation costs."

Before this announcement, all income from monetary penalties issued by the ICO were passed to the Government's central Consolidated Fund and the ICO did not retain any of the funds. The new agreement is therefore a significant shift from the previous system and will allow the ICO to recover a portion of its monetary penalties per annum.

The ICO commented in its announcement that the change means the ICO can make sure they "have the right resources to hold those who don't comply to account" but also so that the ICO can "make sure that more of the charges paid by small businesses can be used to directly fund our business advice and support services."

This is an interesting development which adds a further dynamic to the issue of monetary penalties, particularly those pursuant to the UK GDPR which have the potential to be significant. The ICO's comments indicate that this agreement will provide the ICO with at least some of the funds it requires to ensure that appropriate action is taken to hold businesses to account and may indicate a pending uptick in regulatory action.

It will be interesting to watch how the ICO approaches monetary penalties going forward and whether there is any change in appetite to investigate or a greater emphasis placed on the cost of the ICO in each matter when issuing a monetary penalty. Equally, we will be keeping an eye on whether the ICO starts to push back more robustly in response to appeals against monetary penalties. Over recent years, we have seen the ICO reduce GDPR monetary penalty notices, most recently in the case of Clearview AI Inc's fine for more than £7.5m last month which showed a drastic reduction from the provisional view to fine the organisation just over £17m in November 2021. Whether the ICO alters its approach to monetary penalty notices going forward remains to be seen.

It will also be interesting to see if any EU data protection authorities follow suit, either adopting the ICO's hybrid model or going further and following the model in Spain where the Spanish data protection authority - Agencia Española de Protección de Datos (AEPD) - is self-funding and retains all income received from civil penalties (fines) issued by the AEPD.

“Being able to recover some of our litigation costs will form an important part of ensuring that the ICO has the right tools to do our job. We are on the side of the public and responsible businesses and being well resourced to take action can give everyone the confidence that, where appropriate, we will act effectively to uphold rights.” James Dipple Johnston, Chief Regulatory Officer, ICO.

Source:  Clyde & Co

Working with the Law Society

The ABI is the only association in this industry to be recognised by the Law Society of England and Wales, and included in the Law Society of Scotland's approved Supplier Scheme.

The highest independent professional bodies for solicitors put their trust in us. We’re confident you can do the same.

The ABI other partners also recognise the value of affiliation to the principal professional body in the investigation and litigation support sector:

COURTSDESK SEARCHER is an on-demand search for court cases, or parties involved in court cases, in England and Wales and the Republic of Ireland.
Scotland Law Society logo
Professional Indemnity Insurance
Thank you, your message has been sent.
A member of our team will be in touch shortly.