The draft of this crucial statutory instrument is now available online and aims to have effect from ‘GDPR day’, 25 May
The draft Data Protection (Charges and Information) Regulations 2018 have been published. They are available as a pdf on the legislation website here. As you might expect, they aim to come into force on 25 May 2018.
The draft is subject to Parliamentary approval but, especially given the limited time available, they are unlikely to change.
As regards fees, the draft bears little relation to the pre-consultation figures (set out here).
The first 21 days of GDPR threaten to bring an avalanche of information to the ICO door as those data controllers who did not pay a fee under the old regime are required to send information and a fee within that period.
Regulation 3 makes provision for the amount of a charge to be paid by a data controller to the Information Commissioner in respect of each charge period. Three tiers of charge are prescribed, in the amounts of £40, £60 and £2900 according to criteria relating to a data controller’s turnover and number of members of staff (or only members of staff, for a public authority). Specific provision is made for charities and small occupational pension schemes and the charge is reduced if a data controller pays the charge by direct debit.
The descriptions of exempt processing are set out in paragraph 2 of the Schedule to the Regulations and cover non-automated processing; processing undertaken for the purposes of personal, family or household affairs; processing for the purpose of the maintenance of a public register; processing for the purposes of operations involving staff administration; processing for the purposes of advertising, marketing and public relations in respect of the data controller’s own activities; processing for the purposes of accounts, record keeping and the making of financial forecasts; processing carried out by non profit-making organisations for certain purposes; and processing for the purposes of exercising judicial functions.