The Information Commissioner’s Office (ICO), the UK’s data regulator, made headlines in July 2019 when it announced its first two fines for data breaches under the General Data Protection Regulation (GDPR). Both fines were unprecedented compared to enforcement action taken by other regulators in Europe under GDPR.
The first announcement was the hefty £183m fine levelled at British Airways (BA) after personal data of around 500,000 customers, including payment card data was hacked. Then came hotel chain Marriot International, which was hit with a £99.2m fine after personal data of seven million UK-related guest records was accessed. By any stretch, a combined fine of £282.2m was a serious flex of regulatory muscle.
