UK regulator gets tough on information request breaches

Angelique Bret and Tadeusz Gielas, who specialise in competition and consumer law at Pinsent Masons, were commenting after the CMA fined Euro Car Parks £473,000 for failing to respond to a mandatory request for information (RFI). The fine amounts to 75% of the maximum penalty the CMA could have issued in the case. The CMA issued the RFI in exercise of enforcement powers it has under UK consumer law.

It is the first fine to be imposed by the CMA in the context of its new consumer protection enforcement powers under the Digital Markets, Competition and Consumers Act 2024 (DMCC Act). Bret said it demonstrates that the CMA fully intends to flex its new powers to impose fines for procedural breaches, particularly in connection with requests for information.

According to Bret, it was a long-standing frustration of the CMA under the previous enforcement regime that it did not have the power to force companies to provide it with the information it needed to investigate potential breaches of consumer law. If companies did not supply the information requested under the previous regime, the only option was for the CMA to apply to the court for an order. For example, in the context of its investigation of the anti-virus software sector, the CMA applied to court for an order in relation to Norton, which had failed to supply certain information requested.

The CMA can now fine companies up to 1% of global annual turnover for failing to comply, without reasonable excuse, with an RFI issued under UK consumer protection law. Non-compliance with an RFI issued under UK competition law can result in the same level of maximum turnover-based civil fine.

In the Euro Car Parks case, the company took three months to respond to the CMA’s RFI – and only then after the regulator had advised of its intent to impose a fine.

According to the CMA, Euro Car Park’s response came after it had contacted the company on seven separate occasions through a variety of different means, including “delivery by registered post, by hand, and multiple emails to company directors”. The company treated the emails as attempts to defraud it so blocked them, but the regulator said this was not a reasonable excuse for its delayed action.

A court rejected an application by Euro Car Park to issue an order that would have prevented the CMA from naming the company when publicising the RFI breach. The CMA said that it has not opened a consumer law enforcement case against the company but is currently assessing whether to do so. It said that “no assumption should be made”, as a result of the RFI breach fine, that the company has infringed consumer law.

Angelique Bret of Pinsent Masons said: "The fine shows the CMA is serious about using its new DMCC Act fining powers to punish procedural breaches and to enforce compliance with mandatory information requests. Parties that receive a RFI from the CMA, whether in the context of a competition law or a consumer law investigation, may now face substantial fines up to 1% of their global annual turnover if they fail to comply without reasonable excuse."

"The CMA's penalty decision adds to its existing published guidance on what may constitute ‘reasonable excuse’ for non-compliance with an RFI under its new direct enforcement consumer law powers, and clarifies that the CMA will not accept arguments that a party thought the CMA's RFI was an attempted 'scam'. The fine is below the statutory maximum, and the CMA has refrained from imposing daily penalties for ongoing non-compliance which could have led to a significantly higher total fine,” she said.

Tadeusz Gielas, also of Pinsent Masons, added: “The CMA expects businesses to be at least aware of the CMA and its role, and it has published extensive business compliance guidance – both on its consumer law as well as its competition law investigatory powers – since relevant DMCC Act provisions came into force last year, and will also expect businesses to be aware of these."  

Separately, the CMA currently has eight live consumer protection enforcement investigations, which it opened in November 2025. It expects to provide further updates on those cases next month.