The new data protection fee – ICO cracks down on non-payment!

The Information Commissioner’s Office (ICO) has recently issued 34 enforcement notices to organisations who have failed to pay the new data protection fee under the GDPR and Data Protection Act 2018 (DPA 2018). We understand that more such enforcement notices are to follow soon.

These enforcement notices serve as a reminder to organisations that the ICO is taking GDPR and DPA 2018 enforcement seriously and is committed to ensuring organisations are aware of (and comply with) their obligations!

What is the data protection fee?

Under the old legislation (the Data Protection Act 1998) all data controllers had to be registered with the ICO and paid a fee for this registration based on the size and turnover of the organisation (£35 or £500), which was renewed on an annual basis.

Under GDPR and the DPA 2018, the requirement to register with the ICO has been removed and organisations no longer need to notify/register with the ICO but instead must pay a fee – the “data protection fee” depending on the size of the organisation.

This fee was established under the Data Protection (Charges and Information) Regulations 2018 and came into force, alongside the GDPR and DPA 2018, on 25 May 2018 (see our earlier blog on this here)

There are three tiers of fee charged by the ICO, depending on the size of the organisation:

Tier 1 (Micro organisations) – these are organisations with a turnover of less than £632,000 or that have no more than 10 staff = £40 fee (or £35 if you pay by direct debit).

Tier 2 (SMEs) – these are organisations with a turnover of less than £36 million or that have no more than 250 staff = £60 fee.

Tier 3 (Large organisations) – these are organisations with more than 250 staff or a turnover of more than £36 million = £2,900 fee.

Do I have to pay it?

In short – yes. If you process personal data, you need to pay the data protection fee[i].

If you have an existing registration under the old legislation which was renewed prior to 25 May 2018, you do not need to pay the new data protection fee until your registration expires.

What happens if I don’t pay?

If you don’t pay – you could be one of the organisations on the receiving end of an enforcement notice from the ICO. This first batch of 34 notices will serve as a reminder to many organisations to pay the data protection fee. The ICO has made clear that more notices are at the drafting stage and will be issued soon.

Failure to pay the data protection fee may result in a fine from the ICO – this will be calculated based on the size of your organisation but could be as much as £4,350!

All of the organisations who have been sent these enforcement notices have 21 days to respond – if they pay the ICO will stop the enforcement action.

Conclusion

This action by the ICO should serve as a reminder to organisations that the new data protection fee must be paid or you risk fines/other enforcement action by the ICO.

The new GDPR and DPA 2018 obligations for organisations can be confusing, however it is clear that if you are processing personal data – you should be paying the data protection fee to the ICO!

If you require any advice and/or assistance in relation to the GDPR or DPA 2018, please do not hesitate to get in contact with our dedicated data protection team who would be delighted to assist.

[i] There are a limited number of exemptions.

This article we co-written by Rebecca Henderson.

Technology, Media & Telecoms

With very few areas not impacted by technology, media and telecoms, we remain focused on ensuring we stay ahead of the curve in advising clients of the ever-increasing body of law, regulation and policy affecting the sector.

Latest updates from @MacRoberts

  • Our award-winning Family Law team can help you and your partner through difficult situations by providing support w… https://t.co/sOwEmv13fP 27/07/2021
  • To celebrate the Olympic Games in Tokyo, we're delighted to launch our latest sporting challenge in support of our… https://t.co/Y8IEq3eT53 23/07/2021
  • MacRoberts is recruiting! We are currently looking for a Real Estate Planning Solicitor to join the MacRoberts tea… https://t.co/ioGQaF2hQc 23/07/2021
  • The countdown is on! With just 100 days to go, we’re looking forward to #COP26 in Glasgow! ♻️ As a firm accredite… https://t.co/Ooldhmo8tW 22/07/2021
  • Has lockdown led you to consider a move to the countryside? From discussing a possible purchase to obtaining the… https://t.co/patbF42pjk 22/07/2021
  • Have you seen our latest vacancies? 💼 We currently have opportunities in various departments across the firm. Fin… https://t.co/NpiWs2sphg 21/07/2021
  • Acas has published new guidance for employers with helpful information on #flexibleworking & #hybridworking. With t… https://t.co/SoX87hFkko 20/07/2021
  • Busting the myth that a career in law is only for the privileged few: @marikaflawyer is speaking at this morning’s… https://t.co/awfcub4cw0 19/07/2021
  • MacRoberts is recruiting! We are currently looking for a Support Services Assistant to join our team in Edinburgh.… https://t.co/DJ27fRmmdb 16/07/2021
  • MacRoberts is pleased to have been part of the team advising @HV_Systems in its £5m capital boost from Beehive Equi… https://t.co/BxcwjCgIVk 15/07/2021
  • MacRoberts is recruiting! We are currently looking for a NQ Solicitor to join our Conveyancing & Private Client te… https://t.co/zubGY4zo0D 14/07/2021
  • For the last of our IGTV mini-series, we hear from Katie MacLeod. She will be giving an insight into what it’s like… https://t.co/0v2nNQ9zzZ 14/07/2021
  • RT @marikaflawyer: Exciting opportunity for Associate in our award winning Family Law team #familylaw #LegalCareer https://t.co/z3WEtfFJUo 14/07/2021
  • MacRoberts is recruiting! We are currently looking for an Associate to join our Family Law team in Edinburgh or Gl… https://t.co/CaitiMeVBs 14/07/2021
  • Last week, the UK Government took the decision to relax the rules on the length of time lorry drivers can work as a… https://t.co/o559McerYg 13/07/2021