ICO Enforcement and Penalties: What Journalists Need to Know

Overview of the ICO's enforcement powers

The Information Commissioner's Office is the UK's independent data protection and information rights regulator. Its enforcement powers span three overlapping legal frameworks: the Freedom of Information Act 2000 (FOIA), the Environmental Information Regulations 2004 (EIR), and the UK General Data Protection Regulation together with the Data Protection Act 2018 (UK GDPR/DPA 2018).

Under FOIA and EIR, the ICO's main tools are decision notices (s.50 FOIA) and enforcement notices (s.52 FOIA). These bind public authorities and can ultimately be enforced through the Upper Tribunal as contempt of court. Under UK GDPR, the ICO can issue monetary penalty notices (MPNs) of up to £17.5 million or 4% of global annual turnover — a power with no equivalent under FOIA.

FOIA also contains a criminal offence provision at s.77 targeting those who deliberately destroy or conceal records to prevent disclosure. Together these mechanisms form a credible enforcement toolkit — though the ICO's capacity to pursue every case means that the most impactful enforcement tends to follow systemic or egregious failures.

Decision notices under s.50 FOIA

When a person makes a complaint to the ICO — typically after an unsatisfactory internal review — the Commissioner has the power to investigate and issue a decision notice under s.50 FOIA. A decision notice sets out the ICO's findings on whether the public authority has complied with its obligations under the Act, and where appropriate, specifies the steps the authority must take and the timeframe within which it must take them.

Decision notices are legally binding on public authorities. An authority that disagrees with a decision notice may appeal to the First-tier Tribunal (Information Rights) within 28 calendar days. If it does not appeal, it must comply with the steps specified. Decision notices are published on the ICO's website and constitute a substantial body of precedent on how exemptions are applied in practice.

For journalists, the ICO's database of decision notices is a primary research tool. Searching by public authority reveals which bodies are repeatedly refusing to disclose, which exemptions are being over-applied, and which types of information the ICO has previously ordered to be released. Decision notices can also be cited in support of new FOI requests to similar authorities.

Enforcement notices under s.52 FOIA

If a public authority fails to comply with the steps required in a decision notice, the Commissioner may issue an enforcement notice under s.52 FOIA. An enforcement notice specifies the steps the authority must take to comply and sets a deadline. The authority can appeal an enforcement notice to the First-tier Tribunal.

If an authority then fails to comply with an enforcement notice without reasonable excuse, the Commissioner can certify that failure to the Upper Tribunal. The Upper Tribunal can deal with the authority as if it had committed a contempt of court. This is the ultimate sanction under FOIA — and while it is rarely invoked, the threat is sufficient to prompt compliance in most cases.

Note that certain public authorities — specifically those listed in s.52(3) FOIA, which includes the Houses of Parliament and certain intelligence bodies — are exempt from enforcement notices. For those bodies, the Commissioner's reach is limited to decision notices and recommendations.

Monetary penalty notices under UK GDPR

Monetary penalty notices (MPNs) under UK GDPR and the Data Protection Act 2018 are not a FOIA mechanism — they apply when an organisation has committed a serious data protection infringement such as a large-scale data breach or systematic unlawful processing. The maximum penalty is £17.5 million or 4% of global annual turnover, whichever is higher.

MPNs are directly relevant to journalists in two ways. First, a data breach affecting a news organisation or a source database can trigger ICO investigation and potentially an MPN — understanding the ICO's approach helps newsrooms assess their own compliance risk. Second, MPNs issued against public bodies, companies, or institutions are newsworthy in their own right and are published on the ICO website with detailed reasons.

The ICO can also issue reprimands (a non-financial regulatory action introduced post-Brexit) where an infringement has occurred but an MPN is not considered proportionate. Reprimands are also published and represent a formal finding of non-compliance.

Criminal offences under s.77 FOIA

Section 77 of the Freedom of Information Act 2000 creates a specific criminal offence. It is committed where a person employed by, or an officer of, a public authority alters, defaces, blocks, erases, destroys, or conceals any record held by the authority with the intention of preventing the disclosure of information that the applicant would have been entitled to receive under the Act.

Prosecution under s.77 is by summary conviction only — meaning it is heard in the magistrates' court and carries a fine rather than imprisonment. The requirement to prove intent makes successful prosecution difficult, and the offence is rarely prosecuted in practice. However, its existence is significant: it means that deliberate record destruction in response to an FOI request is a criminal act, and evidence of such destruction can be raised in an ICO complaint or tribunal proceedings.

Journalists who have reason to believe that records have been destroyed or concealed in response to their request should document any evidence of this and raise it explicitly in their ICO complaint. The ICO has the power to carry out assessments of a public authority's practice and may investigate systemic records management failures even where a s.77 prosecution is not pursued.

Appealing to the First-tier Tribunal (Information Rights)

Both the complainant and the public authority have the right to appeal a decision notice to the First-tier Tribunal (Information Rights). The appeal must be lodged within 28 calendar days of the date the decision notice is served. The Tribunal is administered by His Majesty's Courts and Tribunals Service and sits as a specialist judicial body dealing with information rights cases.

A key feature of the First-tier Tribunal's jurisdiction is that it conducts a de novo review — it is not confined to reviewing whether the ICO made a legal error, but can re-examine the merits of the exemption claim afresh and may inspect the withheld information itself. This makes the Tribunal a genuine second opportunity to secure disclosure, distinct from a judicial review.

If either party wishes to challenge the Tribunal's decision, a further appeal on a point of law lies to the Upper Tribunal (Administrative Appeals Chamber). From there, an appeal can proceed to the Court of Appeal and ultimately the Supreme Court, though such cases are rare. Tribunal decisions are published and constitute important precedent for how exemptions are interpreted.

How ICO enforcement matters to journalists

ICO enforcement actions are themselves a news source. Decision notices issued against central government departments, local councils, NHS trusts, and police forces are published on the ICO website and can reveal systemic failures in transparency obligations. An enforcement notice issued against a public body — particularly one that was already the subject of a decision notice — is evidence of repeated non-compliance that may justify a story in its own right.

• 1
  Track decision notices for patterns

  Search the ICO's decision notice database by public authority to identify bodies that are repeatedly refusing disclosure of particular types of information.
• 2
  Use enforcement notices as accountability evidence

  An enforcement notice confirms that an authority has failed to comply with a binding legal ruling. That is a story — especially for local accountability journalism.
• 3
  Monitor monetary penalty notices

  MPNs against public sector bodies or large institutions are published with detailed reasons. They can reveal data security failures, systemic mishandling of personal data, or gaps in compliance.
• 4
  Cite precedent in new requests

  Decision notices that ordered disclosure of information similar to what you have requested can be cited in your request or in an internal review challenge to strengthen your position.
• 5
  Use the Tribunal as a reporting resource

  Published Tribunal decisions — especially where the withheld information is ultimately disclosed — can be rich sources of information about what public bodies sought to conceal and why.

For guidance on filing an FOI request, handling refusals, and escalating to the ICO, see our related guides below. For a ready-to-use complaint template, see the ICO Complaint Template and Internal Review Template.

Frequently asked questions