The ICO stepped this up earlier this year when it began identifying organisations which they had issued fines to; 123 in total between 1 January and 31 March 2019. Of those 7 were issued to organisations in the education and childcare sector.
The first appeal of a fine for non-payment of fees – issued against Farrow and Ball – was dismissed in April with the ICO remarking that “there is no excuse for non-payment”.
Under the Data Protection (Charges and Information) Regulations 2018, organisations that process personal data need to pay a data protection fee to the ICO, unless they are exempt.
Independent schools that have charitable status will fall into tier 1. The fee for tier 1 is £40. The level of the data protection fee for other independent schools will depend on the school’s turnover and size of its workforce, although tiers 2 and 3 are likely to apply to most of them.
Schools that are not also charities will fall into tier 2 if their maximum turnover is £36 million in their financial year or they have no more than 250 members of staff. The fee for tier 2 is £60. Larger independent schools with turnovers exceeding £36 million, and where they have 251 or more members of staff, are required to pay the tier 3 fee of £2,900.
If your school has not paid its data protection fee, which must be paid annually, this can be done on the ICO’s website at www.ico.org.uk/fororganisations/register/ or by calling them on 0303 123 1113.