ICO Threatening letter

[jabes]

ICO have just posted a lovely letter to many UK businesses threatening that they must pay and subscribe or face a fine of £4000 if their business handles personal information.
Now my question is - if your client is an individual and you email or call them (which with the exception of shops, almost every business does), then have you processed personal information and therefore liable to the ICO fee... or would it only constitute processing personal information if you are processing that information to be stored for marketing purposes?

 

[ecommerce84]

They have a tool on their website to determine whether you need to register and pay:

https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/

 

[jabes]

Thanks @ecommerce84 . I’ve been through that and it’s quite confusing to say the least. Eg. Question 7:
7. Are you processing information for any of the following purposes?
It then lists jobs.... surely a purpose of processing information could be for marketing... not a list of jobs.
If you then select any of the jobs it says you must pay.
If you select ‘none of the above’ then it says you don’t need to pay as you are only processing information you require to run your business... so I’m not sure why the type of business is relevant.

 

[Andy Harris]

The part of the letter that jumps out the most is: 'There are not many situations where you would be exempt from paying a fee' ... which implies that most businesses would have to do it.

I'm in the wrong line of business - should be a government department with an excuse to charge millions of businesses £40+ a year - gotta be the fastest revenue generator around right now.

Just waiting for the "you are a business with humans that breathe air, therefore you must pay a £50/year fee for breathing that air" letter.

 

[bodgitt&scarperLTD]

So if someone emails you, you are then 'processing their information'?

I'd have more respect for the ***** if they just stuck the £40 on corporation tax.

 

[MikeHunter]

I looked at this very closely when GDPR came into effect. I concluded that we weren't a data processor. However, when we got one of those letters I looked into it again and concluded that we would have to pay. Its a relatively straghtforward process to register and pay. Not saying I'm a fan of the scheme. Its another bit of Government bureaucracy, and I'd have thought that we already pay more than enough in taxes that the Government should directly fund the ICO rather than charging already stretched small businesses.

 

[nick34785]

I did the tool questionnaire and it said we don't have to pay as we only use the data to conduct our necessary business.

 

[wayzgoose]

Well I'm miffed now - I haven't had a letter !

 

[fisicx]

I’ve had two. Do you want one of them?

 

[wayzgoose]

I’ve had two. Do you want one of them?

How much?

 

[Paul Kelly ICHYB]

About 95% of businesses in the UK are not registered and they probably should be!

 

[rob0098]

Paul with respect Id say you either haven’t used the checker tool or you secretly work for the ICO!

Step 8 of the assessment checker tool is stated below. If you only hold customer details for your own marketing and communications purposes you are under no requirement to register.

I would suggest that 95% of businesses DO NOT need to pay, and the letter is a government led deliberately misleading cashcow.

Dear ICO. How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties..ah no wait its easier to threaten small businesses and duping them into a £60 digital parking fine!


For those that can answer the below criteria with a YES, the link you need is:
The ICO website address followed by /no-fee (I can’t post links yet as I’ve only just joined the forum)

“advertising, marketing and public relations (in connection with your own business activity).
You only hold the personal information of the people you need to for your own advertising, marketing and public relations – for example information about past, existing or present customers or suppliers

The information is restricted to what is necessary for your advertising, marketing and public relations – for example, names, addresses and other identifiers

You only advertise and market your own goods and services”

 

[Paul Kelly ICHYB]

@rob0098
You only get to 8 if you don't make a selection from 7 (there may be the odd exception but I'm not testing them all) - that's 33 generic business descriptions that equate to a lot of actual businesses!

You only hold the personal information of the people you need to for your own advertising, marketing and public relations – for example information about past, existing or present customers or suppliers

Does this include leads you generate!

hese companies DO sell information to third parties.

And I am sure you agreed to this when you signed up for the service!

We could sit here and discuss the minutia of details, however, for £35, it is a lot easier and safer just to register, unless it is blatantly obvious one doesn't hold data.

 

[Darren_Ssc]

About 95% of businesses in the UK are not registered and they probably should be!

How many of these businesses have been penalised for not registering then, I wonder?

 

[Paul Kelly ICHYB]

Probably none!

 

[rob0098]

Theres a great Times article on it.

Again, I can’t post the link, but if you google “Times ICO” its a good read.

 

[Paul Kelly ICHYB]

The first paragraph of that article looks great!!!

 

[rob0098]

Theres a free article on decisionmarketing co uk website that gets to the real reason. ICO have failed to hit budget by 1.3M! Threatening letter all makes sense now!

 

[Aniela]

Dear ICO. How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties..ah no wait its easier to threaten small businesses and duping them into a £60 digital parking fine!


For those that can answer the below criteria with a YES, the link you need is:
The ICO website address followed by /no-fee (I can’t post links yet as I’ve only just joined the forum)

“advertising, marketing and public relations (in connection with your own business activity).
You only hold the personal information of the people you need to for your own advertising, marketing and public relations – for example information about past, existing or present customers or suppliers

The information is restricted to what is necessary for your advertising, marketing and public relations – for example, names, addresses and other identifiers

You only advertise and market your own goods and services”

Sounds like you just hate the government/ICO and have a personal vendetta against anything like this, based on things you conjure out of thin air... rather than understanding the truth and reality.

Google, Facebook and Amazon do not sell customer information to third party companies.

Further to that point, those companies are ICO registered anyway, so your argument is flawed on so many levels.

 

[Mr D]

Paul with respect Id say you either haven’t used the checker tool or you secretly work for the ICO!

Step 8 of the assessment checker tool is stated below. If you only hold customer details for your own marketing and communications purposes you are under no requirement to register.

I would suggest that 95% of businesses DO NOT need to pay, and the letter is a government led deliberately misleading cashcow.

Dear ICO. How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties..ah no wait its easier to threaten small businesses and duping them into a £60 digital parking fine!


For those that can answer the below criteria with a YES, the link you need is:
The ICO website address followed by /no-fee (I can’t post links yet as I’ve only just joined the forum)

“advertising, marketing and public relations (in connection with your own business activity).
You only hold the personal information of the people you need to for your own advertising, marketing and public relations – for example information about past, existing or present customers or suppliers

The information is restricted to what is necessary for your advertising, marketing and public relations – for example, names, addresses and other identifiers

You only advertise and market your own goods and services”

If one of those big companies have sold your information on then by all means complain to their data officer or ICO.
However odds are they are not selling your information. Quite likely you have been giving it away left right and center. Fines for abuse of information can be considerable and big organisations spend a considerable amount to avoid being fined. Cheaper that way.

 

[Fagin2021]

This reminds me of a blag by the Performing Rights Society some years ago who hired an agency to extract fees from unaware businesses. It went something like...

The telephone goes..

“HellothisisSarahfromthePerformingRightsSocietycallsarerecordeddoyouplaymusicatwork?”

Me: ”Pardon?”

“ThisisSarahfromthePerformingRightsSocietydoyouplaymusicatwork?”

Me: ”What?”

“Do you play music at work?”

Me: ”No”

“Do you listen to the radio or have a television on?”

Me: “Why?”

“You need a license”

Me: “Depart dear lady and peace be with you.” (paraphrase).

 

[rob0098]

Sounds like you just hate the government/ICO and have a personal vendetta against anything like this, based on things you conjure out of thin air... rather than understanding the truth and reality.

Google, Facebook and Amazon do not sell customer information to third party companies.

Further to that point, those companies are ICO registered anyway, so your argument is flawed on so many levels.

You're missing my point! The Google Facebook thing was a side-note - (and if they are so innocent why is My Zuckerburg always being dragged over the coals regarding privacy!? Cambridge analytica?)

The main point is the ICO have sent out a heavy-handed letters to small business stating MOST businesses should pay - when in fact MANY should not. Its a blatantly misleading.

Perhaps you're grumpy because you've paid your ICO bill without looking into it?
Someone's gotta assist with their 1.3M deficit I suppose!

 

[SillyBill]

I now do my level best to not engage with these type of things with government, pay my CT in full and keep my head down is my attitude, increasingly place the rest of them on ignore. The amount of bureaucracy & form filling seems to gets worse and worse year on year, despite technology supposed to be making lives easier...

The last straw for me that changed my attitude was the ONS getting their teeth into us, I filled their forms out studiously for years and yet the reward was more and more and more surveys landing on the mat, with more threats for non-completion. They get a sucker on the line and that is their invitation to harass and bombard you. The final trigger was when I got the Annual Business Survey for the third year in a row (supposed to be at random and a small sample of UK businesses). Anyone who has got that form will know its half a days job filling it in. Add into the 2-3 other forms they were sending on a monthly basis...I started ripping them up from that point on and never filled another one in since. Still get them coming from time to time albeit reduced considerably. Their prosecution rate is dismally low and I don't really care anymore, I've got a business to run.

 

[Aniela]

You're missing my point! The Google Facebook thing was a side-note - (and if they are so innocent why is My Zuckerburg always being dragged over the coals regarding privacy!? Cambridge analytica?)

The main point is the ICO have sent out a heavy-handed letters to small business stating MOST businesses should pay - when in fact MANY should not. Its a blatantly misleading.

Perhaps you're grumpy because you've paid your ICO bill without looking into it?
Someone's gotta assist with their 1.3M deficit I suppose!

Now you're changing the argument. You clearly don't know the details of Cambridge Analytica either, as Facebook didn't buy/sell data there. That was a separate issue.

You said "How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties" - Which is a lie and false information.

You're here hitting on the ICO for a 'hard-hitting' letter, while yourself posting lies/false information. Or I should say mis-information by accident. You just were discussing something you don't have any idea about. You just like to have an overall hate on something, without considering facts.

A heavy-hitting letter is irrelevant. If a business owner gets upset/scared about a letter like that, they shouldn't be a business owner. It's like any legal letter. Lots of big words which usually amount to pretty much nothing.

I pay my ICO bill as I'm required to. The 1.3 deficit is irrelevant. If people should be paying it, they should be paying it. Nothing more, nothing less to it.

If someone gets a heavy hitting letter saying to check if you should pay it and you pay it without checking, they need to re-evaluate what they're doing.

 

[fisicx]

I pay my ICO bill as I'm required to.

I don't. Because I'm not required to.

 

[Mr D]

I don't. Because I'm not required to.

Indeed - on checking once we got the initial letter we also are not required to pay and informed them of that.
Perhaps in a year or two the situation will change and we become liable to pay.

 

[UKSBD]

You said "How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties" - Which is a lie and false information.

They don't have to sell information on to third parties - they just buy the 3rd parties instead

 

[rob0098]

You said "How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties" - Which is a lie and false information.
.

okaaayy "The Facebook–Cambridge Analytica data scandal concerned the obtaining of the personal data of millions of Facebook users without their consent by British consulting firm Cambridge Analytica, predominantly to be used for political advertising.[1]"

As I say Anna you're missing the main point of my argument. I feel that the ICO are preoccupied sending misleading letters to small business, and blanket taxing the little-people. Small businesses that have enough worries at the moment thanks to the pandemic. We don't need more threats / taxes / fines on our doorstep.

The whole thing is ironic in any case...so I just pay £40-£60 and then somehow I'm magically data-safe? I'd rather spend the money on security software, training and implementation.

I guess we are going to have to agree to disagree on this one. You seem in favour of rad tape and big business.

The point of my original post was to alert fellow SMEs that they may not have to pay -not sure why you're nitpicking it and pulling it apart. All I wanted to say was "Hey - small business - check before you blindly pay this!"

 

[DontAsk]

okaaayy "The Facebook–Cambridge Analytica data scandal concerned the obtaining of the personal data of millions of Facebook users without their consent by British consulting firm Cambridge Analytica, predominantly to be used for political advertising.[1]"

"Obtaining" the data is different to "being sold" the data. Stop digging.

 

[Newchodge]

Paul with respect Id say you either haven’t used the checker tool or you secretly work for the ICO!

Step 8 of the assessment checker tool is stated below. If you only hold customer details for your own marketing and communications purposes you are under no requirement to register.

I would suggest that 95% of businesses DO NOT need to pay, and the letter is a government led deliberately misleading cashcow.

Dear ICO. How about you go after Facebook, Google and Amazon? These companies DO sell information to third parties..ah no wait its easier to threaten small businesses and duping them into a £60 digital parking fine!


For those that can answer the below criteria with a YES, the link you need is:
The ICO website address followed by /no-fee (I can’t post links yet as I’ve only just joined the forum)

“advertising, marketing and public relations (in connection with your own business activity).
You only hold the personal information of the people you need to for your own advertising, marketing and public relations – for example information about past, existing or present customers or suppliers

The information is restricted to what is necessary for your advertising, marketing and public relations – for example, names, addresses and other identifiers

You only advertise and market your own goods and services”

So, presumably, that would mean those who hold details in order to invoice their customers ARE required to register?

 

[rob0098]

So, presumably, that would mean those who hold details in order to invoice their customers ARE required to register?

Hi Cyndy - thank goodness a normal person that knows how to get the post back on topic!

No, step 8 indicates you can use customer data for your core business activities. This can EVEN include marketing to them. So invoicing, accounts, everyday business activities solely relating to you and your business mean you are under no requirement to pay.

 

[Paul Kelly ICHYB]

No, step 8 indicates you can use customer data for your core business activities.

What happens if you do not get to step 8 and get an answer at 7?

BTW, Cyndy, if you follow that guidance, you will not be able to collect lead data, business cards at networking events (for marketing) or info at trade shows.

 

[Newchodge]

Hi Cyndy - thank goodness a normal person that knows how to get the post back on topic!

No, step 8 indicates you can use customer data for your core business activities. This can EVEN include marketing to them. So invoicing, accounts, everyday business activities solely relating to you and your business mean you are under no requirement to pay.

NORMAL!!!!!!!!!!!!???????????????? Thanks

 

[Newchodge]

What happens if you do not get to step 8 and get an answer at 7?

BTW, Cyndy, if you follow that guidance, you will not be able to collect lead data, business cards at networking events (for marketing) or info at trade shows.

I provide payroll services to small employers. I am registered

 

[rob0098]

What happens if you do not get to step 8 and get an answer at 7?

Ummm then you have to pay - like it tells you.

re your point about lead data. As far as I understand the rules (no expert) you're not allowed to email anyone without consent these days regardless of coughing up your £40-£60 fine...I mean fee.

The fact someone has given you a business card is consent.