Digital Economy Act 2017

Charges payable to the Information Commissioner

108 Regulations about charges payable to the Information Commissioner

(1) The Secretary of State may by regulations require data controllers to pay charges of an amount specified in the regulations to the Information Commissioner.

(2) Regulations under subsection (1) may require a data controller to pay a charge regardless of whether the Information Commissioner has provided, or proposes to provide, a service to the data controller.

(3) Regulations under subsection (1) may make provision about the time or times at which, or period or periods within which, a charge must be paid.

(4) Regulations under subsection (1) may make provision—

(a) for different charges to be payable in different cases;

(b) for cases in which a discounted charge is payable;

(c) for cases in which no charge is payable;

(d) for cases in which a charge which has been paid is to be refunded.

(5) The Secretary of State may by regulations make provision—

(a) requiring a data controller to provide information to the Information Commissioner, or

(b) enabling the Commissioner to require a data controller to provide information to the Commissioner,

for either or both of the purposes mentioned in subsection (6).

(6) Those purposes are—

(a) determining whether a charge is payable by the data controller under regulations under subsection (1);

(b) determining the amount of a charge payable by the data controller.

(7) The provision that may be made under subsection (5)(a) includes, in particular, provision requiring a data controller to notify the Information Commissioner of a change in the data controller’s circumstances of a kind specified in the regulations.

(8) In this section “data controller” means a person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

(9) In subsection (8) “personal data” means any information relating to an identified or identifiable individual.

(10) For this purpose an individual is “identifiable” if the individual can be identified, directly or indirectly, in particular by reference to—

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(11) Where the purposes and means of the processing of personal data are determined by or on behalf of the House of Commons or House of Lords, other than where they are determined by or on behalf of the Intelligence and Security Committee of Parliament, the data controller in respect of those data for the purposes of this section is the Corporate Officer of that House.

109 Functions relating to regulations under section 108

(1) Before making regulations under section 108(1) or (5) the Secretary of State must consult—

(a) the Information Commissioner,

(b) such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate, and

(c) such other persons as the Secretary of State thinks appropriate.

(2) In making regulations under section 108(1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Information Commissioner under such regulations are sufficient to offset—

(a) expenses incurred by the Commissioner in discharging the Commissioner’s functions—

(i) under the Data Protection Act 1998,

(ii) under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426),

(iii) under the General Data Protection Regulation,

(iv) under regulations which implement the General Data Protection Regulation or the Criminal Data Directive,

(v) by virtue of section 108, and

(vi) under this section,

(b) any expenses of the Secretary of State in respect of the Commissioner so far as attributable to those functions,

(c) to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and

(d) to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the Superannuation Act 1972.

(3) In subsection (2)—

• “the Criminal Data Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA;

• “the General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(4) The Secretary of State may from time to time require the Information Commissioner to provide information about the expenses referred to in subsection (2)(a).

(5) The Information Commissioner must keep under review the working of regulations under section 108(1) or (5) and may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.

(6) The Secretary of State must review the working of regulations under section 108(1) or (5)—

(a) at the end of the period of five years beginning with the making of the first set of regulations under that section, and

(b) at the end of each subsequent five year period.

110 Supplementary provision relating to section 108

(1) Regulations under section 108(1) or (5) are to be made by statutory instrument.

(2) A statutory instrument containing regulations under section 108(1) or (5) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

(3) Subsection (2) does not apply to a statutory instrument containing regulations which—

(a) only make provision increasing a charge for which provision is made by previous regulations under section 108(1), and

(b) do so to take account of an increase in the retail prices index since the previous regulations were made.

(4) Such a statutory instrument is subject to annulment in pursuance of a resolution of either House of Parliament.

(5) In subsection (3) “the retail prices index” means—

(a) the general index of retail prices (for all items) published by the Statistics Board, or

(b) where that index is not published for a month, any substituted index or figures published by the Board.

(6) Regulations under section 108(1) or (5)—

(a) may make different provision for different purposes;

(b) may make transitional, transitory or saving provision;

(c) may make incidental, supplemental or consequential provision.

(7) Regulations under section 108(1) or (5) may bind the Crown.

(8) But regulations under section 108(1) or (5) may not apply to—

(a) Her Majesty in Her private capacity,

(b) Her Majesty in right of the Duchy of Lancaster, or

(c) the Duke of Cornwall.

(9) For the purposes of section 108 each government department is to be treated as a person separate from any other government department.

(10) In subsection (9) “government department” includes—

(a) any part of the Scottish Administration;

(b) a Northern Ireland department;

(c) the Welsh Government;

(d) any body or authority exercising statutory functions on behalf of the Crown.

111 Amendments relating to section 108

(1) The Data Protection Act 1998 is amended in accordance with subsections (2) to (7).

(2) Omit Part 3 (notification by data controllers).

(3) In section 33A(1) (manual data held by public authorities) omit paragraph (e) (but not the “and” following that paragraph).

(4) In section 71 (index of defined expressions) omit the entries relating to “address”, “fees regulations”, “notification requirements”, “prescribed” and “registrable particulars”.

(5) In Part 2 of Schedule 1 (interpretation of the data protection principles) in paragraph 5 omit paragraph (b) and the “or” preceding that paragraph.

(6) In Part 1 of Schedule 5 (the Information Commissioner) in paragraph 9(1) (destination of fees etc) after “the Freedom of Information Act 2000” insert “and all charges received by the Commissioner under regulations under section 108(1) of the Digital Economy Act 2017”.

(7) In Schedule 14 (transitional provisions and savings) omit paragraph 2 (registration under Part 2 of the Data Protection Act 1984).

(8) In regulation 5(3)(b) of the High Court Enforcement Officers Regulations 2004 (SI 2004/400) (application procedure) omit paragraph (iii).

(9) In consequence of the repeal in subsection (2) the following are repealed or revoked—

(a) section 71 of the Freedom of Information Act 2000;

(b) in paragraph 6 of Schedule 2 to the Transfer of Functions (Miscellaneous) Order 2001 (SI 2001/3500)—

(i) in sub-paragraph (1), paragraphs (h) to (m), and

(ii) sub-paragraph (2);

(c) in paragraph 9(1)(a) of Schedule 2 to the Secretary of State for Constitutional Affairs Order 2003 (SI 2003/1887), the words “16, 17, 22, 23, 25, 26,”;

(d) Part 1 of Schedule 20 to the Coroners and Justice Act 2009;

(e) paragraph 26 of Schedule 2 to the Transfer of Tribunal Functions Order 2010 (SI 2010/22).