Is your Parish Council registered with the ICO?

I have discovered over the last few weeks while doing internal audits that a number of parishes are still not registered with the Information Commissioner’s Office and haven’t paid the data protection fee.

The reason for registering with the ICO is that under the Data Protection (Charges and Information) Regulations 2018 which came into force in May 2018, organisations that determine the purpose for which personal data is processed (controllers) must pay a data protection fee unless they are exempt – and Parish Councils are unlikely to be exempt, as even receiving letters and emails from villagers would count as processing personal data! This fee replaces the requirement to ‘notify’ (or register), which was in the Data Protection Act 1998.

So while Parish Councils might not be “public authorities”, they are still processing data and therefore have to pay the data protection fee. More information is available here – https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-fee/

However, PCs don’t have to have a Data Protection Officer as the legislation was changed at the last minute.

The ICO has created a Parish Councils Resource Pack which may also be of use.

You will also need to ensure that you have the associated Freedom of Information Publication Scheme published (this is a standard document available on the ICO’s website – just put “Parish Council Publication Scheme” in the search bar – which can be adapted for your needs). As part of the GDPR suite of policies, you should also have a Document Retention Policy and a Data Protection Policy.