United Kingdom: Closed consultation on draft for ICO Data Protection Fining Guidance

On 27 November 2023, the UK Information Commissioner’s Office (ICO) closed the public consultation on the draft for the Data Protection Fining Guidance under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The draft outlines the legal framework that enables ICO to impose fines, the factors assessed in the decision to impose a penalty and the fine amount. Furthermore, the draft specifies ICO’s approach in cases of multiple infringements, noting that the fine will not exceed the penalty for the gravest infringement.