ICO Issues First Enforcement Action Under the GDPR

The UK's Information Commissioner’s Office has issued the first formal enforcement action under the EU General Data Protection Regulation and the UK Data Protection Act, on Canadian data analytics firm AggregateIQ Data Services Ltd., which is challenging the decision. AIQ was found to be in breach of articles of the GDPR for processing personal data in a way that data subjects were not aware of, for a purpose they would not have expected, and without a lawful basis for processing.