The closer that it gets to accountancy the more probable that you need to be registered with the ICO.
Mmm, define owning the data?
If I input the data on my machine using my software then it is mine, not the clients.
If I input data on their machine using their software then it belongs to them.
Therefore I would say that the government perception of what a bookkeeper does is incorrect and by extension their statement as to whether one needs to be registered is incorrect.... But... As the people needing you to register are saying the wrong thing does that in itself make what they are saying correct?
Here's the ICAEW helpsheet on the matter which may help :
p.s. Many thanks to Chris for spotting the error in the link. Now fixed
-- Edited by Shamus on Tuesday 15th of October 2013 10:15:07 PM
__________________
Shaun
Responses are not meant as a substitute for professional advice. Answers are intended as outline only the advice of a qualified professional with access to all relevant information should be sought before acting on any response given.
I can see that this topic has been discussed a few years ago but wondered if anything had changed.
As far as I can see it, as bookkeepers we do not need a data protection licence as we do not own the data (the client does) and therefore do not need to register. I completed the ICO online questionnaire and it came back as no need to register, but I just like to be doing things correctly.
Ha, I was just about to ask the same question myself.
I've been talking to quite a few small business owners recently (not book-keepers) and it appears that 99% of them are not registered with the DPA. I always thought that you had to be registered if you kept any details at all (name, address, tel no etc) on a computerised system.
Perhaps I've been foolishly and unnecessarily filling the government's coffers for years!
If you keep information about living individuals on a computer, or in a manual filing system that will reveal personal information about the individuals (more than, say, name and address, but not much more) then you need to register, unless you are simply processing a data owner's records. This could be you.
But if you are processing, you should not be retaining the information after the job is done.
My rule of thumb is, if the data stays on my system, I own it and must therefore be registered. If the data is stored on a client's system, then he is the owner and I am simply processing.
-- Edited by ilsm on Tuesday 15th of October 2013 09:14:07 PM
-- Edited by ilsm on Tuesday 15th of October 2013 09:14:55 PM
Im in the process of registering at the moment so to get an answer would be great. I thought if you were holding any details be it manual papers or computerised you would need to be registered?
Now fixed and tested and the link now works correctly.
kind regards,
Shaun
__________________
Shaun
Responses are not meant as a substitute for professional advice. Answers are intended as outline only the advice of a qualified professional with access to all relevant information should be sought before acting on any response given.
I thought I would jot down the questions from the ICOs own self assessment system that is to be used to determine whether to register or not.
1 Are you a not for profit organisation that qualifies for an exemption? Y or N. I ticked No.
2 Does your business or organisation only process information for judicial functions? Y or N. I ticked No.
3 Are you processing personal information? Y or N. I ticked Yes.
4 Do you process the information electronically? Y or N. I ticked Yes.
5 Is your organisation responsible for deciding how the information is processed? Y or N. Underneath the question it says "Answer No if you only process information on behalf of another organisation." I ticked No.
It then returns that "You are under no requirement to register"
That makes sense, but it is never as cut-and-dried as it would appear
The following guidance is relevant:
A service provider who processes personal data to carry out a service using his expert or professional skill and knowledge (and in the case of many professionals, such as accountants and lawyers, in accordance with professional and ethical standards regulated by a professional body) is likely to be acting as a data controller [emphasis supplied]. While the client provides the initial broad instruction to the service provider (and ultimately pays for the service), where the service provider is required to use a considerable degree of independence in determining the way in which he is able to provide the service in accordance with his professional obligations he is likely to exercise a sufficient degree of control over the processing of the personal data to be acting as a data controller.
Is a bookkeeper subject to the kind of professional and ethical standards envisaged? As I believe we have concluded before, whether a bookkeeper is a controller or a processor depends upon the nature of his relationship with his clients. The more advisory it is, the more likely he will be a controller; the more executory, the more likely he will be a processor.
I know this is an old post but thought I would give my take on this, as we have to provide client information to our licence provider in the MLR we are passing information to a 3rd party and should therefore register.
ICO state:
If an exemption applies, then (depending on the circumstances) you will be exempt from the requirement:
to register with the ICO; and/or
to grant subject access to personal data; and/or
to give privacy notices; and/or
not to disclose personal data to third parties.
I registered several years ago to protect myself-at a cost of £35 it isn't a massive expense
I agree with Mark, the cost is low so if in doubt why not register. I work both at client premises and from home so I hold information on my systems and is some cases decide on how the information is processed, ie which software to use if clients don't have a preference, so think the question on ICO website is a little ambiguous.
I don't remember seeing this when I got my Practice Licence ( a whole 14 months ago now!) but it's on the new ICB website -
Do you need to notify?
The Data Protection Act states that, depending on how they handle personal data, some organisations may need to 'notify' the Information Commissioner's Office (ICO). The ICO is the independent body set up to uphold the Act. Notifying is a simple process of registration that can be completed online and costs £35.00 per year. The Act is complex, and understanding exactly who needs to notify can be confusing, however, failure to notify is a criminal offence.
ICB expects all Practice Licence holders to register under the Data Protection Act.
If you are employed by a company, you do not normally need to be registered. Similarly you do not normally need to register if all the work you do as a Practice Licence holder is subcontracted to you by a firm of accountants which is itself registered and which provides instructions to you for how the data should be processed."
I too would agree with Mark. If you are holding data of a personal nature for a client then I believe you should be registered. The cost is minimal and is it worth the risk to later find out that you should have been registered and problems arise.
