Question to the Ministry of Justice:

To ask Her Majesty’s Government what consideration the Information Commissioner’s Office and the Ministry of Justice have given to ensuring that action is taken against all those who have not complied with their registration obligations; what weight the possible disadvantage to those who have paid their due fees is given in deciding whether to prosecute non-registration; and what assessment they have made of whether all those involved in the administration of justice are compliant.

The Data Protection Act 1998 requires every data controller who is processing personal information to register with the Information Commissioner’s Office (ICO) unless they are exempt. Failure to do so is a criminal offence.

The ICO’s website sets out the criteria for notification and provides guidance on the level of fee organisations should be paying. The ICO have also made it easier for organisations to notify and pay the fee by introducing online payments.

In 2014/15 the ICO brought eight prosecutions against organisations for non-notification and two prosecutions for wrong purposes.

The Ministry of Justice and the ICO are looking at the current funding model as part of negotiations on the proposed EU Data Protection Regulation.