ICO Fines Capita £14 Million For Data Breaches

On 15 October the Information Commissioner's Office ("ICO") in the UK issued a penalty notice decision, fining two companies within the Capita Group a total of £14 million for breaches of UK GDPR (£8 million for the parent, Capita plc, as data controller and £6 million for a subsidiary, Capita Pension Services Limited "CPSL", as data processor).

This fine ranks as one of the most substantial levied by the ICO to date in respect of cyber breaches (after appeals are taken into account), below the c.£20 million ultimately levied against British Airways, but well above the average level of fine for UK GDPR breaches. In fact, the final figure represents a discount from the ICO's starting point of a combined £58 million fine. Capita settled with the ICO to reduce the penalty by admitting breaches of the UK GDPR and agreeing not to appeal the decision, along with a discount applied to reflect the fact that these were two group companies and to avoid suggestions of