Monetary penalties · Central government
Ministry of Defence
£350,000penalty
Root cause
Unlawful direct marketing
Nuisance calls, spam texts or emails sent without valid consent — enforced under PECR rather than UK GDPR.
What happened
The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of GDPR Article 5(1)(f). The MOD were fined £350,000.
Summarised from the notice published by the ICO on 26 February 2024. Read the original notice — it is the authoritative version.