| name | ico |
| description | Query the Information Commissioner's Office — the UK's independent data-protection and FOI / EIR regulator. Wraps the HTML index of 'Action we've taken' (enforcement notices, Monetary Penalty Notices, decision notices, reprimands, undertakings, audits) and a generic page fetcher. No JSON API; ICO publishes regulatory action only as HTML. Use when the question is about ICO enforcement against a government department or other body, an FOI decision notice on a public authority, or the regulatory consequences of a data breach. Pairs with `bills` (Data Protection Bills) and `committees` (DSIT / Public Administration committee scrutiny). |
| license | Open Government Licence v3.0 (Crown copyright, ICO) |
| metadata | {"facility":"ico","cli-alias":"ico","base-url":"https://ico.org.uk","provenance":{"tier":3,"operator":"Information Commissioner's Office (ICO)","service":"ico.org.uk","upstream-data":"ICO's own published enforcement actions + decision notices + audit reports + reprimands + undertakings","citation-short":"via Information Commissioner's Office","citation-formal":"Information Commissioner's Office, retrieved {date}, OGL v3.0","confidence":"authoritative","confidence-notes":"Authoritative for ICO's own regulatory output. ICO is a non-departmental public body sponsored by DSIT, with statutory functions under UK GDPR / Data Protection Act 2018 / FOIA 2000 / EIR 2004. Because there is no JSON API, structured extraction from the HTML listings is required for any aggregation."}} |
Information Commissioner's Office
Base URL: https://ico.org.uk
ICO is the UK's independent regulator for data protection (UK
GDPR, Data Protection Act 2018), freedom of information (FOIA
2000), environmental information (EIR 2004), and PECR (cookies /
direct marketing). Its public regulatory output sits under
/action-weve-taken/ and is HTML only — there is no JSON
API and no RSS feed for enforcement actions (probed May 2026).
The library wraps:
| Surface | Path | What |
|---|
| Actions index | /action-weve-taken/ | Umbrella listing of all categories |
| Category index | /action-weve-taken/{category}/ | One category's listing |
| Generic page | /{path} | Any ICO HTML page |
| URL constructor | (client-side) | Build a stable action URL from a slug |
Categories
| Category slug | What |
|---|
enforcement | Enforcement notices, Monetary Penalty Notices (MPNs), undertakings, audits |
decision-notices | FOI / EIR decision notices on public authorities |
audits | Published audit reports |
reprimands | Formal reprimands (introduced as a lighter-touch alternative to MPNs) |
undertakings | Entity undertakings to remediate |
CLI
parl ico actions --text
parl ico by-category enforcement --text
parl ico by-category decision-notices --text
parl ico by-category reprimands --text
parl ico page "action-weve-taken/enforcement/<slug>/" --text
parl ico action-url some-enforcement-slug
Joins to Parliament
- ICO decision notice against a department: when ICO finds a
central government department in breach of FOIA / UK GDPR,
related parliamentary scrutiny lives in
committees
(typically DSIT / Public Administration and Constitutional
Affairs / Justice committees) and written-questions-and-statements.
- Data protection Bills: track the Bills themselves via
bills (e.g. Data Protection and Digital
Information Bill, Data (Use and Access) Bill). The Commissioner
routinely gives written and oral evidence on these.
- ICO Annual Report → debate: ICO lays its annual report
before Parliament; floor debate is searchable via
hansard.
Caveats
- HTML-only. Every aggregation task — counting MPNs in a
year, listing reprimands against NHS bodies, etc. — requires
scraping the listing pages. The library returns raw HTML; the
LLM does the extraction.
- No persistent IDs in the URL. Each enforcement page has a
slug, not a numeric ID. Pages can be re-slugged on publication
of corrections; always store the full URL alongside the slug.
- Decision notices are paginated, sometimes with hundreds of
pages per year. The umbrella index does not enumerate them
all — use
by-category decision-notices and follow the
pagination links in the HTML.
- Reprimands and MPNs are different instruments. A reprimand
is non-financial; an MPN imposes a monetary penalty (up to
£17.5m / 4% of turnover under UK GDPR). Don't conflate.
Provenance to cite
Tier 3 — third-party (ICO), authoritative regulatory output.
- Inline cite: "(via Information Commissioner's Office)" —
once per paragraph.
- For formal output, name the action type, the respondent, and
the date: "ICO Monetary Penalty Notice against {body},
£{amount}, issued {date}, retrieved {date2}". Use the page
URL as the permanent reference.
- ICO is independent of government but sponsored by DSIT. Don't
say "the government fined X" — say "the ICO fined X".
- See
../../docs/provenance.md.
