The Electoral Commission – Reprimand (United Kingdom, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately 40,000,000 individuals, and the initial access was gained via several unpatched software vulnerabilities. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.
Source checks
Source retrieval not recorded.
No automated check recorded.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 2022, a threat actor had access to the Electoral Commission’s systems and was able to access personal data held as part of the Electoral Register. This incident impacted approximately 40,000,000 individuals, and the initial access was gained via several unpatched software vulnerabilities. The investigation highlighted that appropriate technical and organisational measures were not in place at the time of the breach.
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for The Electoral Commission in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
9 May 2024
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. The Electoral Commission - United Kingdom (2024). Retrieved from cookiefines.eu
Last updated: