Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 15 OCTOBER 2016

Talktalk Handed Record Fine In Data Protection Breach In The UK

Proskauer Rose LLP
Proskauer Rose LLP
Contributor
Proskauer Rose LLP

Proskauer Rose LLP

Firm Overview Proskauer is an elite global law firm with more than 900 lawyers across key financial...

View firm profile
Explore more from Proskauer Rose LLP

TalkTalk, a major UK telecoms company, has been fined £400,000 for a data breach after they were hacked. This is a record fine given by the ICO (the UK's data protection authority).

United KingdomPrivacy
Kelly McMullon
Kelly McMullon
Daniel Ornstein
Daniel Ornstein
Author LinkedIn connections

TalkTalk, a major UK telecoms company, has been fined £400,000 for a data breach after they were hacked. This is a record fine given by the ICO (the UK's data protection authority). Significantly the fine was imposed after a change of leadership this summer when Elizabeth Denham (previously the Information Commissioner in the Canadian province of British Columbia) replaced Christopher Graham as the Information Commissioner.

This record fine followed an in-depth investigation by the ICO into an attack by hackers on TalkTalk's systems in October 2015. The hackers obtained the details of 156,959 customers, including their names, addresses, dates of birth, phone numbers and email addresses. In 15,656 cases, the hackers also gained access to bank account details and sort codes. The maximum fine the ICO can require companies to pay is £500,000.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Ten AI Giants, One Regulator And A Lesson For Everyone Else: What The ICO’s Foundation Model Report Really Tells Us

The UK's Information Commissioner's Office has completed its supervision of major AI foundation model developers, revealing significant gaps in data protection practices and setting new expectations for legitimate interests assessments, transparency, and special category data handling. The regulator has now turned its attention to agentic AI systems, warning that autonomy is not an excuse for poor compliance and launching a call for evidence that will shape future regulatory guidance.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

To Fine Or Not To Fine: EDPB Confirms Default Position In GDPR Enforcement Should Be To Fine

The European Data Protection Board has published draft guidelines proposing a fundamental shift in GDPR enforcement: a presumption that fines should be imposed for non-minor infringements, with a deliberately low bar for establishing negligence. Organizations will need to demonstrate robust compliance programs and documented decision-making to potentially avoid penalties, as regulators move from asking "should we fine?" to "can we justify not fining?"
GlobalPrivacy
Crowell & Moring LLP
Crowell & Moring LLP
Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

The ICO's Agentic AI Call For Evidence: What You Need To Know

The UK's Information Commissioner's Office has launched a six-week consultation on agentic AI systems, examining how data protection law applies to autonomous AI agents that can make decisions and take actions with minimal human oversight. The call for evidence focuses on six critical themes including data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful bases for processing personal data.
United KingdomPrivacy
TLT
TLT
Article

Private CCTV, Ring Doorbells And Police Investigations: Where Does UK GDPR Draw The Line?

Domestic surveillance technology has evolved from simple security cameras to sophisticated smart systems that may inadvertently create legal obligations for homeowners. When does a Ring doorbell or CCTV system transform an ordinary citizen into a data controller subject to UK GDPR, and what are the implications of millions of private cameras forming an unregulated surveillance network?
United KingdomPrivacy
HCR Law
HCR Law
Article

SEC Advances “Responsible Retailization” Through A Potential Accredited Investor Exam And Potential Regulated Fund Reforms

On September 30, 2026, the Securities and Exchange Commission (SEC) issued two rule proposals and five notices aimed at expanding investors’ access to private markets. The package would add ways to qualify as an accredited investor, including passing a new exam administered by the Financial Industry Regulatory Authority (FINRA), broaden performance-based compensation and modernize regulated funds, including interval funds and business development companies (BDCs).
United StatesFinance and Banking
Proskauer Rose LLP
Proskauer Rose LLP
Article

CFTC Moves To Reinforce Federal Authority Over Event Contracts As New Jersey Seeks Supreme Court Review

The CFTC has proposed classifying event contracts as swaps while excluding traditional casino-style gambling products, directly responding to ongoing federal-state disputes over prediction markets and sports betting jurisdiction. These regulatory actions seek to clarify the agency's authority over event contracts amid conflicting appellate court decisions and pending Supreme Court review.
United StatesFinance and Banking
Proskauer Rose LLP
Proskauer Rose LLP
Article

DOL Pulls The Plug On Plan To Move FLSA Interpretations Out Of The CFR

The U.S. Department of Labor's Wage and Hour Division has withdrawn its controversial proposal to remove nine parts of longstanding Fair Labor Standards Act interpretive guidance from the Code of Federal Regulations. What does this reversal mean for employers who have relied on these decades-old interpretations, and how does the Supreme Court's Loper Bright decision reshape the legal weight of agency guidance going forward?
United StatesEmployment and HR
Proskauer Rose LLP
Proskauer Rose LLP
Article

New York Employers May Soon Face New Separation Agreement Procedural Requirements

New York State Legislature has passed a bill that would require employers to provide employees with a minimum 21-day review period and 7-day revocation window for separation agreements involving the release of claims. The proposed "No Severance Ultimatums Act" extends procedural protections similar to those under federal age discrimination law to all covered severance agreements, regardless of employee age, and awaits Governor Hochul's signature.
United StatesEmployment and HR
Proskauer Rose LLP
Proskauer Rose LLP
Article

Parliament’s Position On SFDR 2.0

The European Parliament's Committee on Economic and Monetary Affairs has adopted its position on the Sustainable Finance Disclosure Regulation reform, establishing key divergences with the European Commission and Council on professional investor exemptions and fossil fuel investment criteria. With trilogue negotiations set to begin in October 2026, private markets managers face critical decisions about how to position their funds under the new three-category framework expected to take effect in early 2029.
United KingdomCorporate/Commercial Law
Proskauer Rose LLP
Proskauer Rose LLP
Article

New York State Mandates Employee Access To Personnel Records

New York has enacted legislation granting private and public sector employees unprecedented access to their personnel records, including the right to review, dispute, and potentially correct negative information that could impact their employment status. The law, which takes effect in November 2026, establishes strict timelines for employer notification and record access while providing enforcement mechanisms through the State Attorney General.
United StatesEmployment and HR
Proskauer Rose LLP
Proskauer Rose LLP