Following a review of their trial of regulation for public sector bodies, the Information Commissioner’s Office has decided to maintain their current reprimand regime rather than expand their punishments to fines for data protection errors.

In conjunction with a review of the ICO’s public sector policy, John Edwards, the Information Commissioner, commented on the policy.

Currently, the ICO will issue a public reprimand for public bodies if they are found guilty of serious breaches in data protection policy.

Rather than the heavy fines the ICO is empowered to levy on private sector businesses, the ICO has found that reprimands for public sector organisations have proved effective.

Public reprimands can punish organisations reputationally, drawing eyes on any glaring mistakes they have made, whilst leaving room for them to focus on improvements rather than gathering funds for fines.

The policy was introduced in 2022 as a trial, replacing the previous policy of heafty fines along with public reprimands. The new policy was enacted in and effort to actively work with senior leaders to promote data protection compliance in the public sector and proactively prevent any harms before they arise.

Recommended reading

• ICO Releases Guidance on Emerging Privacy Technologies
• ICO: Data Protection Not An Excuse When Tackling Scams, Fraud
• AI Fuels Consumer Demand for Stronger Privacy Laws

Since the trial began, 60 reprimands have been issued to public bodies and are viewable by all on the ICO website, with Edwards saying that this method produced beneficial results in organisations making changes to their data protection efforts and policies.

According to Edwards, public bodies “saw the publication of reprimands as effective deterrents, mainly due to reputational damage and potential impact on public trust, and how they can be used to capture to attention of senior leaders.”

The ICO also noted how imposing fines on public sector bodies “disproportionately affects the budget of smaller organisations and devolved administrations.” For example, the Police Service and Northern Ireland as well as the Ministry of Defence could have faced fines reaching up to £23.2m, instead of £1.2m, had the public sector approach not been applied.

While Edwards and the ICO have decided to continue on with their reprimand-only regime, the Commissioner has launched a consultation on the scope of the approach, asking for input on the ICO’s public sector policy as it moves forward.