ICO demand – is it a scam?

by Readers Question

9:52 AM, 10th December 2019
About 4 months ago

ICO demand – is it a scam?

Make Text Bigger
ICO demand – is it a scam?

Our Ltd company has just received a demand from ICO (Information Commissioner’s Office) claiming that we are not registered with them. That is true…. I have never heard of or from them before.

They say our customers, clients and tenants expect us to take our data protection obligations seriously like the many real estate companies that have paid their fee on time. If we have not paid a data protection fee to ICO we could be liable to pay fines of up to £4000.

In former times we did take personal details from our, mainly student, tenants….names, addresses ,telephone numbers, college details etc. Nowadays however we use agents and although, if we wanted, we could have copies of all tenancy agreements we normally leave all that with the agents.

As we do not hold these details I think the rules (if there are such rules) do not apply to us directly, but might apply to our agents. But something about this demand smells of a scam.

How come we have never heard of this before? Has anybody else received a similar demand?


Editors Note:

ICO blog 03/12/2019 >> Click here

We have launched a campaign to contact all registered companies in the UK reminding them of their legal responsibility to pay a data protection fee. The move marks the start of an extensive programme to make sure the Data Protection Fee is paid by all those who need to pay it.

Under the Data Protection Act 2018 organisations processing personal information are required to pay a data protection fee unless they are exempt. You can quickly and easily find out if your organisation needs to pay the fee by using our self-assessment checker, but if you hold personal information for business purposes on any electronic device, including using CCTV for crime prevention purposes, it is likely an annual fee payment is due.

You can avoid us needing to contact you by either:

  1. Visiting our website to pay your organisation’s Data Protection Fee online
  2. Completing this form to tell us why your organisation is exempt from paying the fee.

Since the new annual data protection fee was introduced in May 2018, over 600,000 organisations have registered to pay it. They have gone on to access the range of services and support we provide to help them to comply with the law and give their customers, clients and suppliers trust and confidence in the way they process personal information. At the same time, between 1 July and 30 September 2019, we issued 340 monetary penalties to organisations that have not paid the Data Protection Fee.

As well as naming most organisations we need to fine, we also publish the names of all fee-paying organisations. This helps them make it clear to their customers, clients and suppliers that they are aware of their legal obligations when processing personal information.

We know data protection legislation can be complicated and we are here to help. The reminders we are sending to organisations are to help make it easy to comply with the law as well as access a great deal of advice and support available from the ICO. This includes:

  • a Helpline and Live Chat service dedicated to supporting small businesses and organisations;
  • a series of self-assessment tools and products on our website;
  • advisory visits and support designed to help small businesses and organisations to comply with the law.

The cost of the data protection fee depends on a company’s size and turnover. There are three tiers of fee ranging from £40 and £2,900, but for most organisations it will be £40 or £60. The cost is reduced by £5 if you sign up by direct debit and you can find out how much you need to pay by taking a self-assessment.

For further help and advice, call the ICO’s small business helpline on 0303 123 1113 between 9am – 5pm, Monday to Friday (excluding Bank Holidays).


David Atkins

14:38 PM, 22nd December 2019
About 4 months ago

I don’t understand how paying £35 per year makes data protection more secure. Its not like they give us free anti virus, firewalls and training on how to avoid phishing scams.

David Price

15:42 PM, 22nd December 2019
About 4 months ago

Reply to the comment left by David Atkins at 22/12/2019 - 14:38
It's nothing to do with data protection. The ICO does not care about data breaches as I know from personal experience, having reported a major breach which the ICO dismissed as inconsequential. It is all to do with HMRC ensuring that us little people pay the correct tax, whilst the likes of Google and Amazon get away largely unscathed by the ravages of taxation.

Michael Barnes

17:55 PM, 22nd December 2019
About 4 months ago

Reply to the comment left by David Atkins at 22/12/2019 - 14:38
It is not about making the data more secure.

Registration is about showing that you understand that you have responsibilities under the law, and it gives a reasonable assurance that you will take action to understand and meet those responsibilities.

The charge is to fund the enforcement and other activities of the ICO, because that is what the law says is to happen.

Michael Barnes

18:01 PM, 22nd December 2019
About 4 months ago

Reply to the comment left by Mick Roberts at 22/12/2019 - 11:54
"My company is not managing the data though."

If your company has customers (tenants?), then legally they are responsible for the personal data that are gathered and processed to manage those customers (or potential customers).

Could you explain how your company operates without managing personal data?

Mick Roberts

18:22 PM, 22nd December 2019
About 4 months ago

Reply to the comment left by Michael Barnes at 22/12/2019 - 18:01
Well, all my tenancies were in my name. No new tenancies since company set up.
All new Lets go with Letting Agent who has all the data.
And as someone above mentioned, these new company set ups a lot of people are doing, one did go in front of a judge & grey area with Possession as Judge wasn't happy it was in the company's name. So even new tenancies with Letting Agent don't go in company name, so what data is my company managing? U tell me? Or maybe ICO Political Correctness will reply Mon to Fri of course.

I'm not an ICO data expert. I'm good at finding a way to keep people in houses.

So do I have to pay again? Do I get my refund & do the £35 £40 in company's name?
This ICO bo__ocks rammel has to remember they are dealing with normal human beings on the ground ie. me without degrees in data & business. And just cause we have a company which the w__ker Govt forced us into, doesn't mean we are then experts on data.

I can't know everything & be good at everything. Although I'm not bad ha ha.

Luke P

19:24 PM, 22nd December 2019
About 4 months ago

Reply to the comment left by Michael Barnes at 22/12/2019 - 18:01
By doing everything on paper…? You are aware Michael that a licence is only required for electronic storing/processing?

Michael Barnes

12:01 PM, 24th December 2019
About 3 months ago

Reply to the comment left by Luke P at 22/12/2019 - 19:24
A common belief, but not true.

It is the way the data are stored.

If, for example, you have a filing system with one file per tenant, then that probably qualifies for registration.

See, for example, https://ico.org.uk/for-organisations/guide-to-data-protection/introduction-to-data-protection/some-basic-concepts/ where it states It only includes paper records if you plan to put them on a computer (or other digital device) or file them in an organised way

Luke P

14:50 PM, 24th December 2019
About 3 months ago

Reply to the comment left by Michael Barnes at 24/12/2019 - 12:01Ridiculous, Michael. And wrong.
You don’t need to register paper records. Do they expect that landlords with paper records should file them in a disorganised fashion? Just scattered about on the floor perhaps?!
The self-assessment tool has three questions:
1). 1. Do you use CCTV for the purposes of crime prevention? [Yes, requires a licence]
2). Are you processing personal information? (‘Processing’ means doing any of the following with the information: obtaining it; recording it; storing it; updating it; and sharing it. ‘Personal information’ means any detail about a living individual that can be used on its own, or with other data, to identify them.) [No to this AND question 1 meaning you do NOT need a licence; ‘Yes’ meaning you also need to answer the third question]
3. Do you process the information electronically? (Answer ‘Yes’ if you process the information using computers or any system that can process the information automatically, including CCTV systems, digital cameras, smartphones, credit card machines, call logging and recording systems, clocking machines and audio-visual capture and storage systems.) [Yes, obviously requires a licence]
Perhaps more importantly, when answering ‘No’ to the third question, the response is: “YOU ARE UNDER NO REQUIREMENT TO PAY A FEE. Organisations that do not process personal information on a computer are exempt. You therefore do not have to pay a fee to the ICO.”

In any case, I believe that page is about general Data Protection and not the necessity to hold an ICO Data Controller licence.

Possession Friend

19:01 PM, 24th December 2019
About 3 months ago

Reply to the comment left by Michael Barnes at 24/12/2019 - 12:01
If you put Registration self-assessment into search of ICO web site you'll get ( initially, depending how you answer,) 3 Questions.
1. Do you use CCTV ( Most Landlords will answer No ) Next,
2 Do you process ( Handle, store etc ) Personal data. ( Most landlords will have to answer Yes, ) Next, and this is the CRUCIAL question.
3. Do you process personal data, Electronically ? If you answer this question with No, the answer to the Self-assessment is NO - you don't have to pay a fee - Register.

Hamish McBloggs

16:17 PM, 30th December 2019
About 3 months ago

Reply to the comment left by Michael Barnes at 21/12/2019 - 17:14
Doesn't one have to invest more than 20 hours/week to be a business according to HMRC ?

1 6 7 8

Leave Comments

Please Log-In OR Become a member to reply to comments or subscribe to new comment notifications.

Forgotten your password?



Save The Date - 29th April 2020 @ 7pm

The Landlords Union

Become a Member, it's FREE

Our mission is to facilitate the sharing of best practice amongst UK landlords, tenants and letting agents

Learn More