Have you received a letter from the Information Commissioners Office? A lot of our clients have been receiving letters from the ICO in recent weeks so we though it would be best to do a quick blog on everything this letter relates to and if you are required to pay a fee to the ICO (Information Commissioners Office). There are so many things to focus on when you are a business, so let’s debunk one more thing to make sure you are in the know.
Who is the ICO and what is their purpose?
The ICO (or Information Commissioners Office) are the UK’s independent body to uphold information rights. Their purpose is to uphold information rights for businesses and individuals in the interest of the public.
Do I need to register and pay the fee?
If you are an individual or company that process personal data you might be familiar with GDPR. In this case, you will need to pay a data protection fee to the ICO (unless you are exempt). The ICO website has a quick and Registration for ICO which will ascertain whether you need to pay the fee or if you are exempt from it.
Who is exempt from the ICO fee?
You do not need to pay if you are only processing data for one or more of the following reasons:
-
Staff administration
-
Advertising, marketing and public relations
-
Accounts and records
-
Not -for -profit purposes
-
Personal, family or household affairs
-
Maintaining a public register
-
Judicial functions
-
Processing personal information without an automated system such as a computer
If in doubt, you can register with the ICO through a self assessment service and find out for certain of your exemption.
Do I need consent to hold an individuals data?
The simple answer to this is no, however, to use an individual’s data without their consent the organisation does need to have a valid reason to do so. A few of the valid reasons are below.
Valid Reasons:
-
Consent
-
Contract
-
Legal Obligation
-
Vital Interests
-
Public Tasks
-
Legitimate interests
Can an individual ask for their data to be deleted?
Yes, they can ask for their data to be deleted from an organisation, however in some circumstances, such as tax or employment reasons, you may need to hold the data on file for a certain period of time.
