DSG to pay £200,000 as consent order ends long-running cyber attack penalty dispute with ICO

The Information Commission (ICO) has confirmed that its long-running enforcement action against DSG Retail Ltd over the 2017 malware attack on Currys PC World and Dixons Travel tills has ended, after the First-tier Tribunal approved a consent order under which the retailer will pay £200,000 of the monetary penalty imposed by the tribunal rather than contest a fresh hearing.

In a statement published on 7 October, the ICO said the settlement reflected the tribunal's earlier findings that DSG had contravened data protection law by failing to put appropriate security measures in place to protect personal data, and brought the litigation to an end. On its website the regulator described the agreement as a "pragmatic and proportionate" alternative to re-running the substantive hearing following the Court of Appeal's remittal of the case in February.

The outcome closes a dispute that began in January 2020, when the ICO imposed a £500,000 penalty, the statutory maximum under the Data Protection Act 1998, after malware installed on 5,390 point-of-sale tills over nine months compromised 5.6 million payment card records and personal data relating to around 14 million people. The First-tier Tribunal upheld the finding that DSG had breached the seventh data protection principle, but reduced the penalty to £250,000 on appeal in 2022.

DSG then took the case to the Upper Tribunal, which accepted its argument that payment card numbers and expiry dates stolen without cardholder names were not personal data in the hands of the attackers, and that the security duty should be assessed from the third party's perspective. The ICO appealed to the Court of Appeal in 2024.

In DSG Retail Ltd v The Information Commissioner [2026] EWCA Civ 140, handed down on 19 February 2026, the Court of Appeal overturned that approach. Lord Justice Warby held that identifiability must be assessed from the perspective of the data controller, and that where an individual is identifiable to the controller the security duty requires that information to be safeguarded regardless of whether the person processing it unlawfully could identify them.

The court also warned of jigsaw identification, where apparently anonymous datasets become identifying when combined with other available information, and found that the Upper Tribunal's reading would have left controllers with no obligation to guard against ransomware or other deliberate interference where attackers could not identify data subjects.

The case was decided under the DPA 1998 and the Data Protection Directive, but the Court of Appeal's interpretation of the security duty is widely regarded as a guide to the equivalent obligations under Article 5(1)(f) and Article 32 of the UK GDPR and the Data Protection Act 2018, where the same question of whose perspective governs identifiability arises in cases involving pseudonymised, tokenised or partial datasets.

The Court of Appeal remitted the matter to the First-tier Tribunal to apply its interpretation to the facts, and DSG had been free to seek permission to appeal to the Supreme Court. Instead, the parties agreed terms, meaning no further hearing will take place and the Court of Appeal's judgment stands as the final word on the point of law.

The ICO said the case reinforced the importance of organisations putting appropriate technical and organisational measures in place to protect personal information, and that the Court of Appeal had confirmed a controller's obligations apply to the personal information it holds and processes, even if that information may no longer be personal information in the hands of a third-party attacker.

Binnie Goh, ICO General Counsel, said at the time of the February judgment that it brought much-needed clarity for people affected by cyber attacks as well as industry, and that the decision strengthened the regulator's ability to take robust action in future.

Goh said the ruling sent a clear message to all organisations that they have a protective duty to safeguard the personal data they hold.

The ICO said the case had now closed.