Somewhat "off topic", but posted here bcause I know that some of you hold data for your own businesses / side interests e.g. societies, etc, and others of you are the experts on topics like this for your employers.

In the UK, the Data Protection act of 1998 requires that "Data Controllers" register with the Data Protection Registrar, for an annual fee of £35.00 on which VAT is NOT payable. Registration involves completing a number of forms that describe where you get your data and what you do with it; the register is publicly accessible and anyone who  wishes can ask you what information you hold on them, and you have a right to have errors corrected, etc.   I'm not a legal expert so this is somewhat of a simplification and is just here as part of my introduction.

We received a "Final Notice" the other day, threatening us that unless we pay £95.00 + VAT to register (it said "Your business has still not submitted registration .... ", which is  wrong) it would be a criminal offense with a fine of up to £5000.00.  Other facts on the notice are misleading too.

Basically, it's a clever scam.  I don't think there's any reason why a company can't offer a service to register for you, but this one is trying to frighten you into sending them £95 because you're currently breaking the law.   If you look at the web site of the Data Protection Registrar, you'll find a link telling you to complain about scams like this to your local trading standards.

I have to stress - it IS clever.  I confess I got something similar a year or so back and I did have a slight panic / check my registration and actually write to the folks to confirm our registration number.  At least I didn't pay them anything   But filing through these people could "cost" you more that their fees ...

The form I've just got provides a small number of tick boxes where you put your data use into one of 15 catergories.  This is a gross simplification and if you get registered from the form by ticking "Information and Database Administration" you'll have a standard profile applied - there are a number on the real data protection registration site, and you'll probably end up on the register as "Buying and selling .... lists of ...  personal details". I had reason to look someone who wanted to sell me some products recently, and I found:

Quote:

PURPOSE 5      Trading / Sharing in Personal Information Purpose Description:      The sale, hire or exchange of personal information. Data subjects are:      Customers and Clients Data classes are:      Personal Details      Family, Lifestyle and Social Circumstances      Employment Details      Financial Details      Goods or Services Provided Sources (S) and Disclosures (D) (1984 Act). Recipients (1998 Act):      Data subjects themselves      Business associates and other professional advisers      Suppliers, providers of goods or services      Survey and research organisations      Traders in personal data Transfers:      None outside the European Economic Area

In other words, they claim to be holding my personal data (such as social circumstances) so that they can sell that information to others ....

To conclude:
1. Don't be frightened by official looking letters - they're not official and they may be wrong
2. Register yourself if you need to - it's cheaper and more accurate

URLs of interest:
http://www.dpr.gov.uk Data protection Registrar home page
http://www.dpr.gov.uk/search.html to search for an entry (look at registration Z545714X for example).  Runs a Perl script!
http://www.dpr.gov.uk/donotbemisled.html For more information on the scam




Hi,

I just got one of these, from the grandly named 'Data Processing Protection Corporation'
Same 95 pounds. Warnings of legal action, some official sounding forms DP1A etc. blah blah.
Basically I binned it.

If you check with the real DPR, you may well find you're exempt anyway..

Anyway, this one is still doing the rounds, so beware!

B

Yep,  we had another a couple of weeks ago.  I kept mine so that I can show it to trainees who haven't seen one before ....  

Your point about not needing to register anyway is a good one ....

---