Question

To ask the Secretary of State for Digital, Culture, Media and Sport, what assessment she has made of whether the Information Commissioner’s Office has the resources it needs to take enforcement action under the Privacy and Electronic Communications Regulations 2003 against large organisations that send unsolicited electronic marketing.

Since 5 February 2026, the Information Commission (ICO) has issued seven monetary penalties under the Privacy and Electronic Communications Regulations 2003 (PECR), totalling £1,215,000.

The Government is responsible for ensuring that the ICO has sufficient resources to carry out its regulatory functions effectively. Last year, we increased the fees levied on data controllers to fund the ICO’s data protection and privacy activities by 29.8%.

The Government has also strengthened the ICO’s investigatory and enforcement powers through the Data (Use and Access) Act 2025, including by introducing new powers to take action against unsolicited direct marketing communications.

DCMS keeps the ICO’s funding arrangements under review through its regular sponsorship discussions, including consideration of the resources required for the ICO to discharge its statutory functions effectively.