‘The Information Commissioner’s Office (ICO) Annual Report for 2024/25 released last week sadly provides evidence of a severe and serious weakening of information rights regulation compared to the strong enforcement which is (and remains) promised especially under the (UK) General Data Protection Regulation (GDPR). Despite even last year’s Report generally revealing formal enforcement such as fines, criminal prosecutions and criminal cautions which were in the single digits only, the Report now omits any reference to UK GDPR enforcement notices (as there were none at all during 2024/25) and states that there were just 2 UK GDPR fines during the year (which compares to >200 in both Germany and Spain) and that even the number of outcomes resulting in reprimands fell from 31 to just 9 (a 70% reduction). Coming on top of concerns over the lack of enforcement action in response to many egregious data breaches including one which put up to 100,000 Afghans at risk of grave harm and possibly even caused death, the Report also reveals that the number of reported data breaches which even resulted in a GDPR investigation (let alone enforcement action) dropped from a mere 6% to just 3%. At the same time, the number of data protection complaints which received no response during the expected 90 day timeframe sky-rocketed from just 15.2% in 2023/24 to 70% in 2024/25 (a 360% increase). As the review of the UK’s EU data adequacy status commences later this year, questions must be asked about these worrying trends and what (if anything) can be done to address them.’
Full Story
UK Constitutional Law Association, 22nd July 2025
Source: ukconstitutionallaw.org
