The Data Protection (Notification and Notification Fees) (Amendment) Regulations 2009

Statutory Instruments

2009 No. 1677

Data Protection

The Data Protection (Notification and Notification Fees) (Amendment) Regulations 2009

Made

2nd July 2009

Laid before Parliament

6th July 2009

Coming into force in accordance with regulation 1

The Secretary of State has consulted the Information Commissioner in accordance with sections 25(4)(b) and 67(3)(b) of the Data Protection Act 1998(1).

The Secretary of State has had regard to the desirability of securing that the fees payable to the Information Commissioner are sufficient to offset the expenses mentioned in section 26(2) of that Act(2).

It appears to the Secretary of State that processing of a description set out in regulation 2 of these Regulations is unlikely to prejudice the rights and freedoms of data subjects.

Accordingly, the Secretary of State, in exercise of the powers conferred by sections 17(3), 18(5), 19(4) and 26(1) of that Act(3), makes the following Regulations:

Citation, commencement and interpretation

1.—(1) These regulations may be cited as the Data Protection (Notification and Notification Fees) (Amendment) Regulations 2009.

(2) This regulation and regulation 2 come into force on 31st July 2009.

(3) Regulations 3 and 4 come into force on 1st October 2009.

(4) In these regulations “the Regulations” means the Data Protection (Notification and Notification Fees) Regulations 2000(4).

Notification: judicial functions exemption

2.—(1) In regulation 3(a) of the Regulations (exemptions from notification) for “5” substitute “6”.

(2) In paragraph 1 of the Schedule to the Regulations, after the definition of “exempt purposes”, insert—

““judge” includes—

(a)

a justice of the peace (or, in Northern Ireland, a lay magistrate),

(b)

a member of a tribunal, and

(c)

a clerk or other officer entitled to exercise the jurisdiction of a court or tribunal;”

(3) In paragraph 1 of the Schedule to the Regulations, after the definition of “staff”, insert—

““tribunal” means any tribunal in which legal proceedings may be brought.”

(4) In the Schedule to the Regulations, after paragraph 5 insert—

“Judicial functions exemption

6.   The processing—

(a) is by—

(i) a judge, or

(ii) a person acting on the instructions, or on behalf, of a judge; and

(b) is for the purpose of exercising judicial functions including functions of appointment, discipline, administration or leadership of judges.”

Amendment of regulation 7 of the Regulations

3.  For regulation 7 of the Regulations (fees to accompany notification under section 18 of the Act) substitute—

“Fees to accompany notification under section 18 of the Act

7.   For the purposes of section 18(5) of the Act the prescribed fee is—

(a) for a data controller in tier 1, £35; or

(b) for a data controller in tier 2, £500.

Fees under regulations 7 and 14: supplementary provision

7A.— (1) For the purposes of regulations 7 and 14, a data controller is in tier 2 if—

(a) it is not—

(i) a charity, or

(ii) a small occupational pension scheme;

(b) it has been in existence for more than one month; and

(c) it—

(i) has a turnover of £25.9 million or more for the data controller’s financial year, and 250 or more members of staff; or

(ii) is a public authority with 250 or more members of staff.

(2) For the purposes of regulations 7 and 14, a data controller is in tier 1 if it is not in tier 2.

(3) In this regulation—

“charity”—

(a)

in relation to England and Wales, has the meaning given in section 1 of the Charities Act 2006(5),

(b)

in relation to Scotland, means a body entered in the Scottish Charity Register maintained under section 3 of the Charity and Trustee Investment (Scotland) Act 2005(6), and

(c)

in relation to Northern Ireland, has the meaning given in section 1 of the Charities Act (Northern Ireland) 2008(7);

“data controller’s financial year”—

(a)

for the purposes of regulation 7, means—

(i)

if the data controller has been in existence for less than 12 months, the period for which it has been in existence on the date the fee is sent to the Commissioner, or

(ii)

in any other case, the most recent financial year of the data controller that has ended prior to the date the fee is sent to the Commissioner, and

(b)

for the purposes of regulation 14, means the most recent financial year of the data controller that has ended prior to the date on which the relevant time expires(8);

“financial year”, in paragraphs (a)(ii) and (b) of the definition of “data controller’s financial year”,—

(a)

in relation to a company, is determined in accordance with section 390 of the Companies Act 2006(9),

(b)

in relation to a limited liability partnership, is determined in accordance with section 390 of the Companies Act 2006 as applied by regulation 7 of the Limited Liability Partnerships (Accounts and Audit) (Application of Companies Act 2006) Regulations 2008(10), and

(c)

in relation to any other case, means the period, covering 12 consecutive months, over which a data controller determines its income and expenditure;

“member of staff” means any—

(a)

employee,

(b)

worker within the meaning given in section 296 of the Trade Union and Labour Relations (Consolidation) Act 1992(11),

(c)

office holder, or

(d)

partner;

“small occupational pension scheme” has the meaning given in regulation 4 of the Occupational and Personal Pension Schemes (Consultation by Employers and Miscellaneous Amendment) Regulations 2006(12);

“turnover”—

(a)

in relation to a company, has the meaning given in section 474 of the Companies Act 2006,

(b)

in relation to a limited liability partnership, has the meaning given in section 474 of the Companies Act 2006 as applied by regulation 32 of the Limited Liability Partnerships (Accounts and Audit) (Application of Companies Act 2006) Regulations 2008, and

(c)

in relation to any other case, means the amounts derived by the data controller from the provision of goods and services falling within the data controller’s ordinary activities, after deduction of—

(i)

trade discounts,

(ii)

value added tax, and

(iii)

any other taxes based on the amounts so derived.

(4) For the purposes of paragraph (1)(c), the number of members of staff of the data controller is to be calculated by—

(a) ascertaining for each completed month of the data controller’s financial year the total number of persons who have been members of staff of the data controller in that month;

(b) adding together the monthly totals; and

(c) dividing by the number of months in the data controller’s financial year.

(5) For the purposes of paragraph (1)(c)(i), in relation to a partnership registered in accordance with regulation 5, the turnover and number of members of staff are the turnover and number of members of staff of the firm as a whole.

(6) For the purposes of paragraph (1)(c)(ii), in relation to a school registered in accordance with regulation 6, the number of members of staff is to be based on the members of staff of both the governing body and the head teacher.

(7) In paragraph (6) “head teacher” includes in Northern Ireland the principal of a school.

(8) If, by virtue of regulation 5 or 6, a notification is given in the name of a firm or school the references in this regulation and regulations 7 and 14 to a data controller are references to the firm or school covered by that notification.”

Amendment of regulation 14 of the Regulations

4.  For regulation 14 of the Regulations (retention of register entries) substitute—

“Retention of register entries

14.   For the purposes of section 19(4) of the Act the prescribed fee is—

(a) for a data controller in tier 1, £35; or

(b) for a data controller in tier 2, £500.”

Michael Wills

Minister of State

2nd July 2009

Ministry of Justice

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations amend the Data Protection (Notification and Notification Fees) Regulations 2000 (“the 2000 Regulations”).

Section 17(1) of the Data Protection Act 1998 (“the 1998 Act”) requires all data controllers to provide a notification to the Information Commissioner and be included on the register of data controllers maintained by the Commissioner under section 19 of the 1998 Act. A data controller is any person who determines the purposes for which and manner in which any personal data are or are to be processed (section 1(1) of the 1998 Act).

Regulation 2 of these Regulations amends the 2000 Regulations to provide an exemption from the obligation to notify in the case of processing for the purposes of judicial functions by a judge or a person acting on the instructions, or on behalf, of a judge.

Under section 18 of the 1998 Act a notification to the Information Commissioner must be accompanied by a prescribed fee. Under section 19 of the 1998 Act any application for a data controller to continue to appear on the register (which must be done annually) must also be accompanied by a prescribed fee. The fee is prescribed in regulation 7 of the 2000 Regulations for the purposes of section 18 of the 1998 Act and in regulation 14 of the 2000 Regulations for the purposes of section 19. The current fee is a flat fee of £35.

Regulations 3 and 4 of these Regulations replace the flat fee with a two-tiered fee structure. The fee for a data controller in tier 1 is £35 and the fee for a data controller in tier 2 is £500. The tier a data controller falls into is based on its turnover and its number of members of staff. If a data controller is a public authority only its number of members of staff is taken into account. Regulation 3 of these Regulations substitutes a new regulation 7 of the 2000 Regulations to create the new fees for the first notification. It also adds a new regulation 7A to the 2000 Regulations containing supplementary provision in relation to regulations 7 and 14, including the definition of the two tiers. Regulation 4 of these Regulations substitutes a new regulation 14 of the 2000 Regulations to create the new fees for the renewal of notification.

(1)

1998 c. 29, as amended by S.I. 2001/3500 and S.I. 2003/1887.

(2)

As amended by section 18(4) of, and Schedule 2 to, the Freedom of Information Act 2000 (c. 36) and S.I. 2003/1887.

(3)

Section 17(3) has been amended by S.I. 2003/1887.

(4)

S.I. 2000/188, as amended by S.I. 2001/1149 and S.I. 2001/3214.

(5)

2006 c. 50.

(6)

2005 ASP 10.

(7)

2008 c. 12 NI.

(8)

The relevant time is defined in section 19(5) of the Data Protection Act 1998.

(9)

2006 c. 46.

(10)

S.I. 2008/1911.

(11)

1992 c. 52. There are amendments to this section that are not relevant to these regulations.

(12)

S.I. 2006/349.