United KingdomUK GDPR Article 82, Data Protection Act 2018 Section 169, and Information Commission Enforcement
UK GDPR, Arts. 82-83; Data Protection Act 2018 §169
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Expect the Information Commission to have jurisdiction and fining power, up to the higher of GBP 17,500,000 or 4 percent of global annual turnover, over your processing of personal data of a person in the United Kingdom.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under UK General Data Protection Regulation (GDPR) Article 82, but expect a UK representative claim to require proof of unlawful use and resulting damage for each individual claimant, not a bare loss-of-control theory, per Lloyd v Google.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority (guidance, recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
DPA 2018 s.157(1) sets the maximum administrative fine for an infringement of the UK GDPR at the amount specified in Art. 83 itself, or the standard maximum amount if Art. 83 specifies none. Section 157(5) defines the higher maximum amount, which Art. 83(5) applies to the gravest infringement categories (basic principles for processing including Art. 9, data-subject rights, the new Arts. 22B/22C automated-decision-making safeguards, and Chapter V transfers): the higher of £17,500,000 or 4% of worldwide annual turnover. Narrower provisions (breach notification, Arts. 33-34) attract the lower standard maximum amount under s.157(6) instead; see the article-scoped rows in this file.
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on it by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover back to , past the twelve-month cutoff. In the twelve months ending (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined 32 actions. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, ), each row counts once as its own published enforcement instrument. Several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
Settledness
- As of
- Guidance link
- https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/
- Guidance body
- Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority
- Open questions
- Does the reading of "damage" in section 13 of the Data Protection Act 1998 in Lloyd v Google LLC [2021] UKSC 50 carry over to "material or non-material damage" under Article 82(1) of the UK GDPR?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation from the controller or processor, Article 83 sets the conditions and ceilings for administrative fines, and section 169 of the Data Protection Act 2018 gives a compensation right for contraventions of other data protection legislation. None of them requires a log or record. Article 82(3) lets a controller escape liability by proving it was not responsible for the event, which is a defence and not a record duty. The Commission's powers to demand information are in sections of the Act this row does not cite.
- Kind
- None
- As of
What this law does
The Information Commission is the UK's single supervisory authority, unlike Germany's 17-authority structure, with UK GDPR Article 83 fines up to the greater of GBP 17.5 million or 4 percent of global turnover. The Information Commission took over the Information Commissioner's functions on .
Section 169 DPA 2018 supplies a private right of action for contravention of data protection legislation other than UK GDPR itself, while UK GDPR's own Article 82 covers contraventions of the Regulation directly; both cover material and non-material damage.
The UK's own Supreme Court has gone further than the CJEU in limiting what counts: Lloyd v Google LLC [2021] UKSC 50 () unanimously rejected a representative claim brought on behalf of millions of iPhone users, holding that compensation under section 13 of the Data Protection Act 1998 for a non-trivial data protection breach requires the individual to show material damage or distress, not a bare loss of control alone, and that such a claim cannot succeed without showing unlawful use and resulting damage for each individual claimant rather than the group as a whole.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .