The cash-strapped NHS could be hit with fines from regulatory body the Information Commissioner’s Office (ICO) as it sends out dozens of warning letters to organisations that failed to pay data protection fees.
Before the new fees structure came into force on 25 May, the same day as GDPR came into effect, organisations had to pay either a £35 fee or a £500 fee depending on their size and turnover. In the new structure, micro-organisations are slapped with a £40 fee, SMBs with an annual turnover of £3.6 million get fined £60, and the largest organisations can face a £2,99 fee.
It should be noted that these fees aren’t the fines themselves, they’re monetary amounts provided in lieu of criminal action for organisations who fail to pay the stated fines.
READ NEXT: Why security and privacy will always be an imperfect balancing act
Regardless of these changes, a host of organisations have been reprimanded for failing to adhere to this new structure, set by the government.
The UK’s data protection regulator sent official warning letters to 34 organisations earlier this month for failing to pay their data protection fees, with more notices in the drafting stage and due to be sent out soon.
Organisations under scrutiny – which include NHS Trusts, governmental organisations, and unnamed accounting, recruitment and finance firms – have 21 days to respond. Failure to pay within this period could see fines of between £400 and £4000 levied, with aggravating factors raising the ceiling to £4,350.
“We expect the notices we have issued to serve as a final demand to organisations and that they will pay before we proceed to a fine,” said the ICO’s deputy chief executive officer Paul Arnold. “But we will not hesitate to use our powers if necessary.
“All organisations that are required to pay the data protection fee must prioritise payment or risk getting a formal letter from us outlining enforcement action.”
READ NEXT: NHS data breach reveals almost 10,000 patient records are lost each year
The ICO, which employs 670 staff, says the fees help to fund the data regulator’s work, which includes upholding information rights and conducting investigations into data breaches and complaints.
The regulator also produces a wealth of guidance for businesses and public sector bodies, especially in light of the introduction of GDPR, and the Data Protection Act 2018 (which cements the European regulations into UK law).
The ICO normally conducts several investigations simultaneously, but a massive proportion of resources have been poured into investigating 30 organisations, including Facebook and Cambridge Analytica, in a wide-reaching data misuse scandal.
Information Commissioner Elizabeth Denham indicated in an interim report, published earlier this year, that the ICO will fine Facebook £500,000 under the Data Protection Act 1998, the maximum permitted.
A significant increase in demand for guidance and information from SMBs has also seen the ICO set up a phone service to handle GDPR requests.
Calls to the helpline increased by 25% in the third quarter 2018 against the second quarter, according to the ICO’s latest annual report, while demand for written advice rose by 40% compared to last year.
Disclaimer: Some pages on this site may include an affiliate link. This does not effect our editorial in any way.
