January 14, 2019

The ICO has begun formal enforcement action against care homes that have failed to pay the data protection fee by sending notices of its intent to fine the businesses unless they pay. Those that fail to pay could face a maximum fine of £600.

The ICO recently sent out the first fines to more than 100 organisations across a range of sectors for non-payment of the fee.

All organisations that process personal data must pay a fee to the ICO and are then listed on their register of data controllers. The care home sector is currently under-represented on this register. There are exemptions from paying the fee but care homes process particularly sensitive personal information for health administration and patient care purposes and are therefore not exempt.

Organisations have 21 days to respond to the notices. If they pay, action will stop.

The data protection fee is part of the Data Protection (Charges and Information) Regulations 2018. It came into force on 25 May to coincide with the new Data Protection Act (2018) and the GDPR. It replaces the need to notify or register with the ICO.

Under the funding model, organisations are divided into three tiers based on their size, turnover and whether an organisation is a public authority or charity. For very small organisations, the fee is no higher than the £35 they currently pay (if they take advantage of a £5 reduction for paying by direct debit). Larger organisations are required to pay £2,900. The fee is higher because these organisations are likely to hold and process the largest volumes of data and therefore represent a greater level of risk.

Those that ignore the notices or refuse to pay may face a fine ranging from £400 to £4,000 depending on the size and turnover of the organisation. Aggravating factors may lead to an increase in the fine up to a maximum of £4,350.

Organisations that have a current registration (or notification) under the 1998 Act, before 25 May 2018, do not have to pay the new fee until that registration has expired. To read the ICO’s press release in full, click here.