We’ve fined Imgur owner, MediaLab AI, Inc., £247,590 for failing to put in place basic protections for children’s personal information.

Our investigation found that the company allowed children to use Imgur without any effective age checks, while collecting and using their data. This in turn exposed them to harmful and inappropriate content,  including material about eating disorders, homophobia, antisemitism, and sexual or violent images.

This fine is part of our wider work to drive improvements in how digital platforms use children’s personal data. Ignoring the fact that children use these services, while processing their data unlawfully, is not acceptable. Companies that choose to ignore this can expect to face similar enforcement action.

A GP surgery shared far too much of a terminally ill patient’s medical information with an insurer. Instead of sending the five years of history the patient requested, Staines Health Group sent 23 years of records, including highly sensitive details the insurer didn’t need to see.

The patient believes this mistake led to a smaller insurance payout.

Health records are some of the most sensitive information we hold, and mistakes like this can cause real distress. That’s why organisations must take extra care to handle medical data correctly and only share what’s necessary.

Two more people have been convicted in UK’s largest nuisance call investigations. This brings the total number of people prosecuted from our investigation to 10.

We have fined two companies a total of £225,000 for sending millions of unsolicited marketing messages in breach of the law. 

We checked how 26 councils are handling Freedom of Information (FOI) requests. While some are doing well, many still need to improve. We support public authorities to get FOI right - but we also step in when organisations don't meet their legal obligations:

• Cumberland Council for not responding to a previous practice recommendation
• Knowsley Metropolitan Borough Council for not publishing compliance statistics
• Halton Borough Council for not publishing compliance statistics

We have opened formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC (X.AI) covering their processing of personal data in relation to the Grok artificial intelligence system and its potential to produce harmful sexualised image and video content.

We have taken this step following reports that Grok has been used to generate non‑consensual sexual imagery of individuals, including children. The reported creation and circulation of such content raises serious concerns under UK data protection law and presents a risk of significant potential harm to the public.