Digital Economy Act 2017

108 Regulations about charges payable to the Information Commissioner

(1) The Secretary of State may by regulations require data controllers to pay charges of an amount specified in the regulations to the Information Commissioner.

(2) Regulations under subsection (1) may require a data controller to pay a charge regardless of whether the Information Commissioner has provided, or proposes to provide, a service to the data controller.

(3) Regulations under subsection (1) may make provision about the time or times at which, or period or periods within which, a charge must be paid.

(4) Regulations under subsection (1) may make provision—

(a) for different charges to be payable in different cases;

(b) for cases in which a discounted charge is payable;

(c) for cases in which no charge is payable;

(d) for cases in which a charge which has been paid is to be refunded.

(5) The Secretary of State may by regulations make provision—

(a) requiring a data controller to provide information to the Information Commissioner, or

(b) enabling the Commissioner to require a data controller to provide information to the Commissioner,

for either or both of the purposes mentioned in subsection (6).

(6) Those purposes are—

(a) determining whether a charge is payable by the data controller under regulations under subsection (1);

(b) determining the amount of a charge payable by the data controller.

(7) The provision that may be made under subsection (5)(a) includes, in particular, provision requiring a data controller to notify the Information Commissioner of a change in the data controller’s circumstances of a kind specified in the regulations.

(8) In this section “data controller” means a person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

(9) In subsection (8) “personal data” means any information relating to an identified or identifiable individual.

(10) For this purpose an individual is “identifiable” if the individual can be identified, directly or indirectly, in particular by reference to—

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(11) Where the purposes and means of the processing of personal data are determined by or on behalf of the House of Commons or House of Lords, other than where they are determined by or on behalf of the Intelligence and Security Committee of Parliament, the data controller in respect of those data for the purposes of this section is the Corporate Officer of that House.