GDPR data protection fee?

[Meldrew]

Hiya.

 

This appears to have completely bypassed me:

 

https://ico.org.uk/media/for-organisations/documents/2258205/dp-fee-guide-for-controllers-20180221.pdf

 

The way I read this (but do correct me if I'm wrong), not for profit schools are exempt as long as any data we process is necessary for our purpose (being a school). I'm sure there would be some things considered not 'necessary' that would mean we have to pay the fee.

 

Meldrew

[djrscally]

Hiya.

 

This appears to have completely bypassed me:

 

https://ico.org.uk/media/for-organisations/documents/2258205/dp-fee-guide-for-controllers-20180221.pdf

 

The way I read this (but do correct me if I'm wrong), not for profit schools are exempt as long as any data we process is necessary for our purpose (being a school). I'm sure there would be some things considered not 'necessary' that would mean we have to pay the fee.

 

Meldrew

 

Not certain. I'm pretty sure the "Not for Profit" thingy means private clubs and that schools will have to pay.

[Bigbird7]

Doesn’t this replace the current ICO registration fee that we pay anyway?

 

I think it will apply from whenever the annual renewal is due. If I’m reading it correctly for public authorities the charge is based on staff numbers, which in this case is all staff. Most will be at the £60 level but anyone who strays over 250 will have to pay £2900! I hope we are classed as Not for Profit!

[Meldrew]

I know we are over 250 so quite substantial in that case.

[Bigbird7]

I wonder where MATs sit here, one fee for the whole trust or is it by each academy

[djrscally]

I wonder where MATs sit here, one fee for the whole trust or is it by each academy

 

Trust as I understand it.

[DODICT]

oh - I'd not seen that the turnover exception for public authorities. quite a jump if the not for profit argument cant be applied then !

[msi]

Schools are not exempt. I called the ICO's office just now and asked about this very question.

 

I explained that I have looked at the ICO's "Guide to Data Protection", specifically the "Exemptions" section, which says;

 

the Act provides exemptions from notification for:

• organisations that process personal data only for: staff administration (including payroll); advertising, marketing and public relations (in connection with their own business activity); and accounts and records;

• some not-for-profit organisations;

• organisations that process personal data only for maintaining a public register;

• organisations that do not process personal information on computer.

 

The lady I spoke with said "there are some exemptions but they only really apply for small, non-profit organisations".

 

I said "what, you mean like a school". She said "no no no".

 

I said "But why, because a school is technically a small, non profit organisation.".

 

She said "no no no".

 

I said "well, without a doubt, the state school I'm currently in is a non-profit organisation, as for it being small, your documents don't define this, at least not the one I'm looking at, can you please provide more information".

 

 

She was in a hurry to get me off the phone, and provided no additional justification for her point. I pushed further, and she passed me onto the notifications team.

 

The notifications team confirmed the school I'm currently working in IS on the register (this is also publicly searchable) and that they should be.

 

I brought up the same points with the second person I spoke with, and she was a little more detailed. She said for an organisation to be "not for profit" it would need to be constituted as a "not for profit", e.g. a charity. A normal "run of the mill" school would NOT normally be exempt.

 

As always, when you delve a little under the surface, the government department in question haven't really got a clue when it comes to providing solid advice which can be referenced in writing, nor do they particularly address points that you or I would consider logical. Nevertheless, they are the ICO, and they said so - schools are not exempt.

 

Secondly I asked "well, who registered this school, as I've spoken to a few people here and nobody has a record of this".

 

I asked "is it possible the DfE have registered the school" - no, this would not have happened.

 

I asked "is it possible the Local Authority have registered the school" - yes this is possible, but not probable.

 

Suggested course of action for all schools, given the above:

 

- check with your LA to see whether they have or haven't registered your school - unlikely

- register your school and pay the annual fee

- spread the word - schools need to know about this very basic fact - they must be on the register!

 

Finally, I joked with the second lady that "I'm sure that the ICO has hired another 500 people to answer phones and undertake the necessary admin of re-sending every school's certificate of registration OR re-sending their security number as they will be probing these things in the coming months".

 

She laughed, and said "in a word - no".

Edited March 8, 2018 by msi

[Meldrew]

Schools are not exemptI brought up the same points with the second person I spoke with, and she was a little more detailed. She said for an organisation to be "not for profit" it would need to be constituted as a "not for profit", e.g. a charity. A normal "run of the mill" school would NOT normally be exempt.

 

Interestingly, we are a charity (or so says our email sig - I'm not aware of the legal side of things). "An exempt charity". I bet it still means we have to pay though.

 

Meldrew

[mb2k01]

Interestingly I've had a live chat session with them today (having not read the update on this thread) and come up with the same response about not being exempt, but also an indication that we might be able to pay under Tier 1 instead!

 

The entire chat is below (posted with the permission of the chat operative which you'll see below!)

My only amendments to the actual chat was my dubious spelling!

 

You are now chatting with ico_sharonb

ico_sharonb: Good afternoon

Mb2k01: Hi Sharon. I'm seeking advice on whether schools / academies / multi-academy trusts have to pay the new DP fee detailed on the following link

Mb2k01: https://ico.org.uk/media/for-organisations/documents/2258205/dp-fee-guide-for-controllers-20180221.pdf

ico_sharonb: If they are required to register then the new fees will apply

Mb2k01: They will have to register, but I wonder whether schools might fall under one of the exceptions in the PDF I linked? Many Multi Academy Trusts are registered as Charities or Exempt Charities for example?

Mb2k01: Most schools / trusts are also non-profit

ico_sharonb: They may - the online self assessment will help them to determine that

Mb2k01: I don't think that registration itself is a query. I believe that most (if not all) schools and trusts will need to. The query is more about whether they are exempt from the fee as not-for-profit organisations - as the definitions given on the above PDF and on question 6 of the registration self assessment don't specifically mentioned schools / academies / trusts

ico_sharonb: Thank you for your patience. I’m considering the matter and will get back to you shortly.

Mb2k01: Thank you! (incidentally, I've noticed that section one of the registration form asks for organisation type, and doesn't explicitly say schools in the drop down - yet if you click on the 'need help' link it seems to suggest schools should be an option

ico_sharonb: If they are required to register they will have to pay the fee (as is the case currently), if they have charitable status it is likely they will be in the lower tier.

Mb2k01: So despite the fact that we might have more than 250 staff, we would still fall under Tier 1?

ico_sharonb: If they have charitable status it is likely to be tier 1

Mb2k01: Is there any literature / link available which confirms that? Apologies for pressing the point, but I'm looking to ensure that I provide the right information to the schools within our Trust

ico_sharonb: I'll just check

Mb2k01: Thanks. Also, is it possible to check again on the position of schools / academies around the exemptions. Point 5 states that you don't need to pay a fee if you are processing personal data for one or more reasons listed - and the list contains not-for-profit purposes.

Mb2k01: Schools and academies are meant to be run as not for profit organisations, and only process information (normally) in accordance with other statutory duties. I can't quite understand why they would need to pay a fee due to that?

ico_sharonb: The guidance you referred to is all we have at the moment. Schools usually have to register because they operate CCTV which removes them from the exemption

ico_sharonb: of only processing data for not for profit purposes

Mb2k01: I understand the registration, just aren't clear on the reason for not being exempt from paying a fee, or the criteria for being assessed and allocated under one of the tiers?

ico_sharonb: Do the schools operate CCTV?

Mb2k01: Yes.. oh, I think I see what you're saying now. Section 5 wants ONLY one or more of the listed reasons. As we also do CCTV that means we're not 'only' processing from that list

ico_sharonb: Yes exactly

Mb2k01: Ok, thanks. I'm clear on that one now - apologies - i misread the para in section 5 initially!

ico_sharonb: No problem. Is there anything else I can help you with today?

Mb2k01: I think all I'm now stuck on is the decision behind which tier a school will fall under. You mentioned above that it was 'likely' to be Tier 1 if we were also registered as an Exempt Charity, but is there any documentation out there which I can use to back that up?

ico_sharonb: Only the guidance on page 5 of the document about exceptions

ico_sharonb: Which states charities will only be liable to tier 1

ico_sharonb: Is there anything else I can help you with today?

Mb2k01: Sorry, I was just re-reading the document. Do you think that there will be new / amended advice issued? I think it would be very useful to have something more explicit mention schools.

ico_sharonb: I'm not aware that there will be more.

Mb2k01: Do you mind if I copy or summarise this chat and put it out in the public domain? If there isn't any planned amended guidance it might help lots of others? (I spent a long time trying to find the answer, and have come across numerous questions in forums asking similar and coming up with different answers!)

ico_sharonb: No problem

Mb2k01: Fantastic. I hope that it will help reduce incoming chat requests / calls for you too! Thanks for your help.

ico_sharonb: Thank you for using our live chat service. Have a good day.

[DODICT]

Just had this confirmed by the ICO

 

Multi Academy trusts that are public authorities with more than 250 staff will be subject to the new upper fee structure.

The not for profit exemption does not apply to public authorities.

 

So its 2900 for most MATs then . . .

[djrscally]

Just had this confirmed by the ICO

 

Multi Academy trusts that are public authorities with more than 250 staff will be subject to the new upper fee structure.

The not for profit exemption does not apply to public authorities.

 

So its 2900 for most MATs then . . .

 

Outstanding.

[mb2k01]

Just had this confirmed by the ICO

 

Multi Academy trusts that are public authorities with more than 250 staff will be subject to the new upper fee structure.

The not for profit exemption does not apply to public authorities.

 

So its 2900 for most MATs then . . .

 

But the conversation pasted above suggests if the Trust is also a Charity / Exempt Charity (which I believe most are?) then the fee will be less?

[DODICT]

I confirmed our circumstances and we also have charitable status but its taken 21 days to come back with that response that stated we would be eligible for the upper fee ?

[mb2k01]

I get the feeling they actually don't really know the answer!

Would make it far easier for us (and them!) if they specified schools and academies in the guidance!

[mb2k01]

If it helps, I had the renewal fee for one of the Trusts I work for late last year and it was just the £60. Btw, I think they re-made the online calculator feature too as I did it again out of curiosity and found it quite hard for a school/Trust to come out on the higher tier now

[Knil92]

wait, so if a school has cctv cameras then they have to pay a fee, but if they dont have cctv then they dont have to pay a fee?

[djrscally]

wait, so if a school has cctv cameras then they have to pay a fee, but if they dont have cctv then they dont have to pay a fee?

 

Err, no. All schools have to pay a fee, it's just the level of fee in slight dispute. The ICO told me the lower tier so that's what I've paid.