1

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-fee/exemptions/ lists exemptions as:

Staff administration

Advertising, marketing and public relations

Accounts and records

Not -for -profit purposes

Personal, family or household affairs

Maintaining a public register

Judicial functions

Processing personal information without an automated system such as a computer. Since 1 April 2019, members of the House of Lords, elected representatives and prospective representatives are also exempt.

but https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/y/N/Y/Yes/Yes lists the exemptions as only:

Judicial functions;

elected representative functions

personal, family or household affairs not connected to commercial or professional activities (including CCTV to monitor your domestic property, even if you are capturing images outside the boundaries of your property); or

to maintain a public register (ie you are required by law to make the information publicly available).

This feels like the ICO are deliberately overreaching in order to increase the number of £40/year fees.

Are they overreaching and how can I find out?

(Note: I'm happy to pay the £40/year fee if I'm legally obliged to. On principle, I don't want to pay if I am being misled by their website's self-assessment guide.)

Improve this question
5
  • 3
    What is your role? Are you on any of these lists?
    – Steve Melnikoff
    Feb 27, 2021 at 13:17
  • @SteveMelnikoff I intend to collect email addresses of users who create an account on my website. They may also pay me via PayPal. I will not give/sell their information to any other party. If they want to pay me via PayPal they have to agree to PayPal's T&Cs. I will not pass their email address to PayPal.
    – fadedbee
    Feb 28, 2021 at 7:58
  • 1
    @fadedbee The legal basis for these charges is The Data Protection (Charges and Information) Regulations 2018. The context makes it clear that accounts are not user accounts but records of purchases. Your user accounts likely involve non-exempt processing of personal data.
    – amon
    Feb 28, 2021 at 8:43
  • @amon Thanks, it looks like I'll need to register with the ICO as soon as a user registers on my website, just to be safe.
    – fadedbee
    Feb 28, 2021 at 15:06
  • @amon If you make it an answer, I'll accept it.
    – fadedbee
    Feb 28, 2021 at 15:06

1 Answer 1

Reset to default
1

Both of the pages linked in the question are from the ICO.

The other exemptions listed on the first page linked but not on the second, seem to be handled on other pages of the self-assessment tool. I have not tried to verify that every exemption listed on the fist page is properly handled, but that seems to be the case.

Which exemption do you think is included in the list on the fist page, but is not covered on the self-assessment tool?

Improve this answer
1
  • I intend to collect email address for users who create an account on my website. They may also pay me via PayPal. I think this is covered by "accounts and records", which would make me exempt on the first list, but not on the self-assessment. I'm am not intending to give this information to any other party. If they want to pay me via PayPal they have to agree to PayPal's T&Cs. I will not pass their information to PayPal.
    – fadedbee
    Feb 27, 2021 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .