Data Protection : Do Not Be Misled!

The Data Protection Act 1998 requires every data controller who is processing personal data to register. There are some exemptions, but failing to register is a criminal offence.

The registration process itself is fairly straightforward and costs £35 per year, but beware! Many local businesses are being contacted by bogus companies claiming to work on behalf of the Data Protection Registrar. These companies are sending out documentation and applications that could easily be mistaken as coming direct from the Registrars Office – some even visit business premises producing identification cards and receipt books.

Although the activities of such companies are not illegal, it is worth bearing in mind for future reference that the official fee for registration is £35.00 – these other companies are asking businesses to part with anything in excess of £95.00. Paperwork can often be of a threatening nature which demands prompt payment “or prosecution is likely to follow”.

There is no connection between the Information Commissioner and such individuals. The Commissioner advises those approached in this way not to make any payment and to notify the local police. The Information Commissioner, Richard Thomas is concerned about the volume of telephone calls and correspondence received by his Office in relation to the activities of this issue and is keen to make clear that there is no connection between his Office and these businesses. He has been disturbed that a number of people have been confused and troubled by the wording and tone of some of the correspondence issued by these businesses. His Office is cooperating with other relevant authorities, who are exploring what action might be taken.

Speaking from his Office in Wilmslow, Cheshire, he said, "I advise data controllers to ignore any approach made by these businesses, who appear to be charging up to £95 + VAT for notification. Other than paying the annual statutory notification fee of £35, on which no VAT is payable, there is no charge made by this Office to any data controller wishing to notify."

Organisations who wish to complain about correspondence received from these businesses should contact their local Trading Standards Office.

Companies that hold databases containing personal details of individuals need to be registered with the Data Protection Registrar. Their web site - www.dataprotection.gov.uk – gives further details of who needs to be registered and who is exempt (see below). It also gives a list of companies that are posing as collectors and emphasises that these companies are in no way connected or authorised by the Registrar to collect fees.

Exemptions are possible for: 

• Some not for profit organisations
• Processing of personal data for personal, family or household affairs (including recreational purposes).
• Data controllers who only process personal data for the maintenance of a public register.

Data controllers who only process personal data for any one or all of the following purposes for their own business:

• staff administration
• advertising, marketing and public relations
• accounts and records

To check if you need to register or to obtain further information/publications regarding the Data Protection Act, please contact:

THE DATA PROTECTION REGISTRAR
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: (01625) 545 745
Fax: (01625) 524 510