Data Controllers’ Registration
766.Paragraph 1 of Schedule 20 amends section 16(1) of the 1998 Act. The Information Commissioner is obliged under section 19 of the 1998 Act to maintain a register of data controller notifications. Section 17(1) of the 1998 Act prohibits the processing of personal data unless the data controller has an entry recording his or her details in the register of data controllers. Section 18(5) of the 1998 Act provides that where a data controller notifies the Information Commissioner, the notification must be accompanied by such fee as may be prescribed by fees regulations. Under section 19(2) of the 1998 Act each register entry shall consist of the registrable particulars of the data controller and such other information as is required by the notification regulations. The term “registrable particulars” is defined in section 16(1). The amendment in paragraph 1 adds a new registrable particular to section 16(1) of the 1998 Act (new subparagraph (h)).
767.The new registrable particular is such information about the data controller as is prescribed under new section 18(5A) of the 1998 Act. Section 18(5A) is inserted by paragraph 2 of Schedule 20 and provides that notification regulations may prescribe the information about the data controller that is required for the purpose of verifying the fee payable under section 18(5). If false information is provided in a notification then this may be an offence under section 5 of the Perjury Act 1911, Article 10 of the Perjury (Northern Ireland) Order 1979 (SI 1979/1714 (NI 19)) or section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995.
768.Paragraph 3 of Schedule 20 amends section 19 of the 1998 Act to add a new subsection (8). It provides that the Information Commissioner will not be required to comply with section 19(6) and (7) in relation to the information that has to be supplied under new section 16(1)(h). Section 19(6) provides for the Information Commissioner to make the register of notifications available to the public for inspection and available to the public in such other ways as he or she considers appropriate. Section 19(7) requires the Information Commissioner to provide certified copies of registrable particulars in the register of notifications to members of the public.
769.Paragraph 4 amends section 20 of the Act to enable regulations to be made requiring data controllers to notify the Information Commissioner of any changes to their registrable particulars for the purpose of ensuring that the correct annual notification fee is paid. Data controllers will not need to provide the Information Commissioner with this information year after year whenever they pay their notification fee. Instead, they will need to provide this information only upon a change of circumstance. Any failure to comply with a duty imposed by such regulations may be an offence under section 21(2) of the 1998 Act.
770.The overall effect of these amendments is to provide a way for the Information Commissioner to check that a data controller has paid the correct notification fee.
