The ICO is offering up to 40% off UK GDPR fines under its new draft Data Protection Enforcement Procedural Guidance. Here's how to take advantage of this special deal!The draft guidance updates the ICO's Regulatory Action Plan, which has been in place since 2018.There are two particularly interesting bits:- New teeth available to the ICO under the Data (Use and Access) Act (DUAA), should it choose to bite with them- A formal proposed settlement processNow the ICO has settled cases before—recently with Capita and Advanced Computer Software Group, for example, and we’ve also seen many fines fall off a cliff edge after the Notice of Intent has gone public. British Airways and Marriott managed to have their proposed fines reduced by around 90% and 81%, respectively. But this is the first time the ICO has proposed a formal, structured settlement process.The idea is to create a streamlined administrative procedure for cases where a penalty notice is likely. The core of the deal is this: in exchange for an early admission of the infringement and an agreement not to appeal the final decision, the ICO will offer a discount on the fine.The draft guidance sets out a tiered discount structure, which provides a clear incentive for early resolution. • A case settled before the ICO issues a "notice of intent" could receive up to a 40% discount. • If it’s settled after the notice of intent but before the organisation submits its written representations, the discount is up to 30%. • Settle after that, and the discount drops to a maximum of 20%.Now I expect some of you might disapprove of a measure that formalises the ICO’s tendency to whittle away at fines until they end up as a small fraction of the controller or processor’s turnover.But it’s worth noting that a formal settlements process like this is already available to other regulators, like the Competition and Markets Authority (CMA), the Financial Conduct Authority (FCA) and Ofcom.

Ver todos los episodios