The ICO clearly isn't fit for purpose

Experts have called for an inquiry into the Information Commissioner's Office – and they couldn't be more right

- 

The UK's data watchdog isn't doing its job – that's according to a recent letter demanding an inquiry into failures of the Information Commissioner's Office (ICO) to act after data breaches.

Not that any of this is new. The ICO set the tone as a watchdog without teeth when it failed to fine Google for slurping up WiFi credentials in 2013, giving it a slap on the wrist and a demand to delete the data. Google learned from that and never collected data accidentally ever again – oh wait, remember DeepMind, the Royal Free Hospital and the kidney app debacle?

To be fair to the ICO, at that time it could only fine up to £500,000, hardly an amount to make Google or any other multinational sit up and take notice. After GDPR came into force, though, the ICO saw a boost to its punitive measures with an increase in penalties to either £17.5 million or 4% of global annual turnover for large companies. For Google last year, that would work out to $14 billion.

Now, that would be an insane fine for collecting a few WiFi logins, but the ICO has doled out a few whoppers since: it slapped Capita with a £14 million penalty following a 2023 cyberattack that leaked the data of 6.6 million people, fined TikTok £12.7 million for misuse of children's data, and whacked BA with a £183 million penalty for a 2018 data breach that impacted 400,000 individuals.