The Cost of a Data Breach: Over £15.5 Million GDPR Fines Paid Out by UK Businesses Between 2023-24

Hayes Connor has conducted an in-depth analysis of recent breaches of the General Data Protection Regulation (GDPR) to assess the financial impact on local businesses throughout the UK. The financial penalties described in each case highlight the critical importance of robust data protection measures in safeguarding personal information and ensuring its responsible usage.

The research uncovered some shocking instances of negligence. In one case, highly sensitive information, including the names of people with HIV, was exposed in emails that weren’t properly 'bcc'd'. Another case involved an extremely vulnerable pensioner with memory loss who was mis-sold various insurances after being contacted without consent, resulting in a loss of between £15,000 and £20,000.

Businesses in major locations such as Manchester, London, Lancaster, Cardiff, Bournemouth, Essex, and Berkshire have received monetary penalties from the ICO between 2023 and 2024, resulting in a total of £15,537,500 in fines.

These findings emphasise the importance of the public reporting such nuisance cases to organisations like the Information Commissioner's Office (ICO) and the Telephone Preference Service (TPS). Often, these reports are enough to trigger an investigation into whether companies are complying with the law.

Here, we will take a deep dive into the 27 instances of monetary penalties received by UK businesses to ascertain the cost of a data breach.

What is GDPR?

The General Data Protection Regulation (GDPR) is a major data protection law enacted by the European Union (EU) that became enforceable on May 25, 2018. It aims to protect the personal data and privacy of individuals within the EU and the European Economic Area (EEA). GDPR also regulates the transfer of personal data outside these regions, impacting organisations worldwide that deal with EU residents' data.

GDPR outlines several key principles for processing personal data, such as lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and ensuring data security. These principles ensure that personal data is handled responsibly and securely.

Individuals have specific rights under GDPR, including the right to access their data, correct inaccuracies, request deletion, restrict processing, and transfer their data to another service. They can also object to certain data processing activities and have protections against automated decision-making.

Organisations processing personal data must comply with various obligations, such as implementing data protection measures by design, conducting data protection impact assessments for high-risk activities, and promptly reporting data breaches. In some cases, they must appoint a Data Protection Officer (DPO) to oversee compliance.

Non-compliance with GDPR can result in substantial fines of up to €20 million or 4% of the organisation's global annual revenue. This regulation sets a high standard for data privacy and has influenced data protection laws worldwide.

Examples of How a Business Can Mistreat Your Personal Information

Businesses in the UK can misuse personal information in several ways, potentially breaching GDPR laws. Here are a few examples:

Unauthorised Data Sharing

Sharing personal data without consent is a common breach. For instance, if a company shares customer email addresses with third-party advertisers without obtaining explicit consent, it violates GDPR.

Example: An online retailer shares its customer email list with a marketing firm without informing customers or getting their consent.

Insufficient Data Security

Failing to protect personal data with adequate security measures can lead to breaches. For example, storing sensitive customer data in unsecured systems makes it vulnerable to hacking.

Example: A healthcare provider stores patient records on an unencrypted server, which gets hacked, exposing sensitive medical information.

Inadequate Transparency

Not informing individuals about how their data is being used is another breach. Businesses must be transparent about data processing activities.

Example: A mobile app collects location data from users without clearly informing them or explaining how the data will be used.

Data Retention Issues

Keeping personal data longer than necessary can also breach GDPR. Businesses should only retain data for as long as it is needed for the specified purpose.

Example: A recruitment agency keeps personal details of job applicants for years after the position has been filled without any legitimate reason.

Ignoring Data Subject Rights

Failing to respect individuals' rights to access, correct, or delete their data is a serious breach. Businesses must respond promptly to such requests.

Example: An online service provider ignores requests from users to delete their personal data from the company's database.

2023-24 Case Studies of ICO Monetary Penalties Due to Breaches of GDPR

All cases where there was a monetary penalty are detailed on the ICO’s website. Here, we’ve broken the information down by the area in which the business is situated, along with the company name, fine amount and reasoning for the penalty.

Manchester Monetary Penalties for GDPR Breaches

London Monetary Penalties for GDPR Breaches

Lancaster Monetary Penalties for GDPR Breaches