The Data Protection (Notification and Notification Fees) Regulations 2000

Explanatory Note

(This note is not part of the Regulations)

These Regulations set out a number of arrangements in respect of the giving of notifications to the Data Protection Commissioner by data controllers under Part III of the Data Protection Act 1998.

Regulation 3 makes provision exempting data controllers carrying out certain processing from the need to notify. The descriptions of the exempt processing operations are set out in the Schedule to the Regulations, and cover processing operations involving staff administration, advertising, marketing and public relations, accounts and record keeping and certain processing operations carried out by non profit-making organisations. Exemption from notification is lost if the processing falls within any description of assessable processing specified by the Secretary of State under section 22 of the Act.

Regulation 4 makes general provision for the form of all such notifications to be determined by the Commissioner. Regulations 5 and 6 make special provision in two cases where there is more than one data controller in respect of personal data; regulation 5 provides for notification by business partners to be in the name of the partnership, and regulation 6 for notification by the governing body and head teacher of a school to be in the name of the school.

Regulation 7 prescribes fees to accompany a notification under section 18 of the Act. A fee of £35 is prescribed.

Regulation 8 provides that an entry in the register of notifications maintained by the Commissioner under section 19 of the Act is to be taken to have been made, for the purposes of avoiding the prohibition in section 17 of the Act on processing without a register entry, in the case of a notification sent by registered post or recorded delivery service on the day after the day it was received by the Post Office, and in any other case on the day it was received by the Commissioner.

Regulation 9 requires the Commissioner to give written notice to a data controller acknowledging receipt of any notification which he considers relates to assessable processing within the meaning of section 22 of the Act. The notice must be given within 10 days of receipt of the notification and must indicate the date of receipt and the processing considered to be assessable processing.

Regulation 10 requires the Commissioner to give notice to a data controller confirming his register entry. The notice must be given as soon as practicable and in any event within 28 days of making a register entry under section 19 of the Act or of amending it under section 20. It must contain the date on which the entry is deemed by regulation 8 to have been made or as the case may be the date of alteration, the particulars entered or amended, and, in the case of a notification under section 18, the date on which the fee provided for by regulation 14 falls due.

Regulation 11 authorises the Commissioner to include certain matters in a register entry additional to the registrable particulars set out in section 16 of the Act. Those matters are a registration number, the deemed date of the entry provided by regulation 8, the date on which the entry may lapse under regulation 14 or 15, and additional information for the purpose of assisting communication about data protection matters between persons consulting the register and the data controller.

Regulation 12 imposes on everyone who has a register entry a duty to notify the Commissioner of any respect in which the entry becomes an inaccurate or incomplete statement of his current registrable particulars or in which the latest description of security matters given under section 18(2)(b) of the Act becomes inaccurate or incomplete. The notification must set out the changes which need to be made to ensure accuracy and completeness, and be given as soon as practicable and in any event within 28 days from the time when the inaccuracy or incompleteness arises. Regulation 12 is modified by regulation 13 in its application to persons who have a register entry by virtue of the manner in which the Act’s transitional provisions operate on entries in the register maintained under section 4 of the Data Protection Act 1984. In these cases, the duty under regulation 12 varies according to the extent to which the entry relates to data which are subject to processing which was already under way immediately before 24th October 1998. In respect of such data, the notification must specify certain aspects of processing which are not from time to time included in the existing register entry; in other cases it must specify any respect in which the entry becomes inaccurate or incomplete in certain respects, and set out the changes needed to ensure accuracy and completeness.

Regulation 14 provides that, other than in the transitional circumstances addressed in regulation 15, the fee to be paid annually to secure retention of a registered entry is £35.

Regulation 15 provides for the retention of register entries included by virtue of the manner in which the Act’s transitional provisions operate on entries in the register maintained under section 4 of the Data Protection Act 1984; these are to be retained until the end of the defined registration period, or 24th October 2001, or the date on which notification is given under section 18 of the Act, whichever occurs first.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.