The Commissioner of Police for the City of London – Violation Found (United Kingdom, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Commissioner of Police for the City of London failed to respond to many requests from people wanting to access their personal data. This matters because timely responses to these requests are important for transparency and trust in law enforcement. The police improved their response rate significantly after the investigation.
What happened
The Commissioner of Police for the City of London did not respond to less than half of the subject access requests within the required time frame.
Who was affected
Individuals who submitted subject access requests to the Commissioner of Police for the City of London.
What the authority found
The Information Commissioner's Office found that the Commissioner violated data protection rules by not responding to access requests on time.
Why this matters
This case highlights the importance of timely responses to personal data requests, especially in law enforcement. It serves as a reminder for public authorities to prioritize compliance with data protection laws.
National Law Articles
The Commissioner of Police for the City of London (the controller) is responsible for law enforcement within the City of London, receiving subject access requests (SARs) falling under Part 3 DPA 2018 for law enforcement processing, as well as some SARs under the UK GDPR for non-law enforcement processing, such as employees’ SARs in HR matters. Several data subjects lodged complaints with the DPA regarding SAR compliance between 2023 and 2025. Subsequently, the DPA launched an investigation into the controller's compliance with SARs. The DPA found that between 1 April 2023 and 31 March 2024, less than half of the SARs submitted had received a response within the statutory time frame. However, the DPA noted that the controller’s compliance with SARs improved to 93% for the period of April 2025 to July 2025. Therefore, the DPA held that between 1 April 2023 and 31 July 2025, the controller infringed Article 12(3) UK GDPR and S45(3) DPA 2018 by failing to respond to subjects’ access requests within the statutory time frame and issued a reprimand along with a recommendation for bringing its activities into compliance.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for The Commissioner of Police for the City of London in UK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. The Commissioner of Police for the City of London - United Kingdom (2026). Retrieved from cookiefines.eu
Last updated: