Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 25 MAY 2018

Examining The ICO's Enforcement Powers Under The GDPR And The DPB

Mishcon de Reya LLP
Mishcon de Reya LLP
Contributor
Mishcon de Reya LLP

Mishcon de Reya LLP

Founded by Lord Mishcon in 1937, in a one-room office in Brixton, Mishcon de Reya now employs over...

View firm profile
Explore more from Mishcon de Reya LLP

Information law analysis: Jon Baines, data protection advisor at Mishcon de Reya, highlights the enforcement powers available to the Information Commissioner's Office (ICO) ...

European UnionPrivacy
Jon Baines
Jon Baines

Information law analysis: Jon Baines, data protection advisor at Mishcon de Reya, highlights the enforcement powers available to the Information Commissioner's Office (ICO) under the General Data Protection Regulation (GDPR) and the Data Protection Bill (DPB).

What enforcement powers and sanctions are available to the ICO under the GDPR and DPB?

The basic powers available to the Information Commissioner (it's worth noting that the powers are vested in the Commissioner herself, and not the ICO) under the GDPR and the DPB do not differ substantially from those under the existing law, ie the Data Protection Act 1998 (DPA 1998).

However, the new regime does bring some changes. The general enforcement powers are specified in the DPB, and are to serve notices, to enter and inspect premises and to bring prosecutions. There are four types of notice—information notices, assessment notices, enforcement notices and penalty notices. In broad terms, these notices have the

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

ICO Consults On Draft Guidance On Anonymisation And Pseudonymisation For Research

The Information Commissioner's Office has launched a consultation on draft guidance addressing anonymisation and pseudonymisation for research, archiving and statistical purposes. This guidance provides critical insight into how organisations should apply data minimisation principles in modern research practices, including AI development, trusted research environments, and synthetic data generation.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

ICO Launches Consultation On Draft Guidance Regarding Anonymisation And Pseudonymisation For Research Purposes

The UK's Information Commissioner's Office has opened a public consultation on draft guidance addressing anonymisation and pseudonymisation techniques for processing personal data in research, archiving, and statistical contexts. The guidance explores critical distinctions between anonymous and pseudonymous data, outlines required safeguards under UK GDPR, and examines emerging technologies including synthetic data and privacy-enhancing tools.
United KingdomPrivacy
A&O Shearman
A&O Shearman
Article

UK Right To Work Checks: What Changes On 1 October 2026

The UK's right-to-work regime is undergoing a fundamental transformation that will extend compliance obligations far beyond traditional employment relationships. From 1 October 2026, businesses engaging contractors, agency workers, platform-based workers, and complex supply chains will face new liability risks that travel up entire contracting chains. Understanding these changes and implementing the required contractual terms, substitution controls, and identity verification systems is now critical for orga
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Meta's $18 Billion Settlement: Reckoning Or Managed Exit?

Meta has agreed to pay up to $18 billion over 10 years to settle claims by 52 US state and territory attorneys general in the largest state consumer-protection settlement in American history outside tobacco. The settlement imposes binding child-safety obligations including time limits and age assurance, but leaves the core algorithmic feed unchanged and raises questions about whether this represents genuine accountability or a commercially managed outcome.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Manchester City: Independent Commission Publishes Decision On Premier League Charges

An independent Premier League Commission has found Manchester City in breach of financial rules spanning nine seasons, with findings that the club artificially inflated revenues and reduced costs by over £900 million. The decision marks what the Premier League describes as the most significant case in its history, though Manchester City strongly disputes the findings and intends to appeal, setting the stage for further proceedings that could reshape English football's regulatory landscape.
United KingdomCorporate/Commercial Law
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Samsung Ordered To Pay The Swatch Group US$11.6 Million In Damages For Trade Mark Infringement

The High Court has awarded the Swatch Group US$11.6 million in negotiation damages against Samsung for trade mark infringements involving watch face apps on the Galaxy App store. Rejecting both parties' extreme valuations of US$170 million and US$301, the court established important principles for assessing damages when brand owners don't license their marks and no comparable market royalties exist.
United KingdomIntellectual Property
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

The New Trade Union Right Of Access: What Employers Need To Do Now

From 30 October 2026, independent trade unions will gain statutory rights to access workplaces - both physically and digitally - regardless of existing union membership or recognition. With tight statutory deadlines for responding to access requests and penalties reaching £500,000 for repeated breaches, employers face a significant shift in how unions can establish themselves in previously non-unionised workplaces.
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Can Insurers Avoid Covering Defence Costs Under A D&O Policy Before Fraud Is Proved?

In a landmark ruling, the English Commercial Court has determined that insurers must continue advancing defence costs under D&O policies even when fraud allegations are pending, provided a non-avoidance clause is present. The decision addresses whether such clauses violate public policy and establishes that insurers cannot withhold coverage until fraud is either admitted or proven by final court decision.
United KingdomInsurance
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: How To Prepare, Monitor And Respond

AI has fundamentally altered how reputation is shaped, with AI-powered search engines now delivering authoritative-seeming summaries rather than traditional search results. From deepfakes and voice cloning to coordinated review bombing and bot-driven harassment campaigns, the threats are evolving rapidly—but so are the defensive tools available to those who understand how to deploy them strategically.
United KingdomMedia, Telecoms, IT, Entertainment
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

R (University Of Sussex) v Office For Students: Reshaping The OfS's Guidance On Freedom Of Speech And Academic Freedom

The High Court's landmark ruling in R (University of Sussex) v Office for Students has fundamentally reshaped how the OfS regulates freedom of speech in higher education, leading to revised guidance that requires holistic policy assessment and proper consideration of remedial actions. With the new free-speech complaints scheme now operational, institutions face heightened scrutiny of their policies and must ensure their frameworks protect lawful speech while meeting equality obligations.
United KingdomConsumer Protection
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: Legal Levers For AI-driven Reputational Harm

AI-generated content poses unprecedented reputational threats, from deepfakes to coordinated bot campaigns. While English law lacks AI-specific remedies, existing legal frameworks—including harassment protections, defamation claims, and the Online Safety Act 2023—offer powerful tools for those who act decisively. The emerging question of AI liability itself remains untested, focusing attention on the human decisions behind AI deployment.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP