United Kingdom

Birthlink

20,725 €

GDPR enforcement action by Information Commissioner (ICO) on 2025-06-24.

Rank · Sector

#24

of 351 in Individuals and Private Associations

Rank · United Kingdom

#25

of 28

Rank · All fines

#1,011

of 3,042

Case details

Authority: Information Commissioner (ICO)
Date: 2025-06-24
Controller / Processor: Birthlink
Sector: Individuals and Private Associations
Quoted Articles: Art. 5 (1) f), (2) GDPR, Art. 32 (1), (2) GDPR, Art. 33 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The UK DPA has imposed a fine of £ 18,000 (EUR 20,725) on Birthlink. The controller, a scottish registered charity, failed to implement sufficient technical and organisational measures to ensure data security, resulting in the loss of irreplaceable personal records.

Open original source Links to the regulator's original publication or another source.