United Kingdom: Adopted ICO Data Protection Fining Guidance

On 18 March 2024, the Information Commissioner's Office (ICO) adopted the Data Protection Fining Guidance under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The guidance outlines the legal framework that enables ICO to impose fines, the factors assessed in the decision to impose a penalty and the fine amount. Furthermore, the guidance specifies ICO's approach in cases of multiple infringements, noting that the fine will not exceed the penalty for the gravest infringement.