Equifax fined the maximum £500,000 by UK's Information Commissioner's Office for failing to protect the personal data of ~15M Britons in 2017 breach
Credit rating agency Equifax is to be fined £500,000 by the Information Commissioner's Office (ICO) after it failed to protect the personal data of 15 million Britons.
Context & Ripple Effects
The ICO's £500,000 penalty on Equifax is the statutory maximum available to the regulator at the time, and it lands as the opening move in an escalation arc visible across the related coverage: weeks later the watchdog hits Facebook with the same maximum £500K fine over Cambridge Analytica, exposing how small the pre-GDPR ceiling was.
The gap closes fast. Within a year the ICO issues a record £183M fine against British Airways under the new regime, while Equifax's own liability migrates to the courts — a $650M-plus US settlement followed by a $380.5M class-action payout. The UK fine becomes the smallest line item in the breach's total cost.
First-order effects
- Equifax pays the maximum fine the ICO can impose for the exposure of ~15M Britons' personal data, and the regulator publicly brands its security failures as among the most serious it has addressed.
Second-order effects
- The identical £500K caps on Equifax and Facebook make the old ceiling politically untenable, clearing the way for the ICO's post-GDPR penalty scale that produces the British Airways record.
Third-order effects
- For data brokers like Equifax, breach economics shift from modest regulatory fines to settlement-scale liabilities — the US payouts dwarfing the UK fine become the template for how breach costs are actually priced.
The trend: Data-breach accountability is moving from capped regulatory fines toward litigation-driven damages, with regulators raising their own ceilings to stay relevant.