The Government has announced a new charging structure for data controllers to ensure the continued funding of the Information Commissioner’s Office (ICO).
The draft structure was laid before Parliament on 20 February 2018 as a Statutory Instrument. The expectation is that it will come into effect on 25 May 2018, to coincide with the General Data Protection Regulation. As it's subject to Parliamentary approval, the contents may still change.
The new data protection fee replaces the requirement to ‘notify’ (or register), which is in the Data Protection Act 1998 (the 1998 Act). An important point to note is that controllers who have a current registration (or notification) under the 1998 Act, do not have to pay the new fee until that registration has expired.
The draft suggests a 3-tier fee system which is determine by reference to the following factors:
- how many members of staff you have
- your annual turnover
- whether you are a public authority
- whether you are a charity
- whether you are a small occupational pension scheme.
Of note is that not all controllers are subject to a fee. More information on the exemptions can be found in section 5 of the guidance.
What are the fees?
Tier 1 – micro organisations
Maximum turnover of £632,000 for the financial year or no more than 10 members of staff. The fee for tier 1 is £40.
Tier 2 – small and medium organisations
Maximum turnover of £36 million for the financial year or no more than 250 members of staff. The fee for tier 2 is £60.
Tier 3 – large organisations
If you do not meet the criteria for tier 1 or tier 2, you have to pay the tier 3 fee of £2,900.
The ICO has stated that they regard all controllers as eligible to pay a fee in tier 3 unless and until you tell them otherwise.
The draft guidance also allows for a £5 discount if you choose to pay your fee by direct debit.
If you process personal data and fail to pay a fee or the correct fee where no exemption exists, you may face a maximum penalty of £4,350.
We'll post an update as soon as the final guidance becomes available.
Markel Law Hub is a digital legal hub powered by the lawyers at Markel Law, bringing you real law, made easy.
Find out more about Markel Law Hub here.
The Government has announced a new charging structure for data controllers to ensure the continued funding of the Information Commissioner’s Office (ICO). The new structure was laid before Parliament as a Statutory Instrument and will come into effect on 25 May 2018, to coincide with the General Data Protection Regulation.