RMC managing agents passing the bill for GDPR ICO registration

sh_kilnao

Please help me understand this.

Consider a fairly small residential management company (RMC) for a block of flats, using the services of managing agents to handle everything to do with the leaseholders, to collect money, handle all contact data, etc. The RMC does not handle any data, just receives reports from the agents, in the form of bills, bank statements, etc.

Are the agents supposed to pass the GDPR ICO bill (of £35) for this block (and in general, each block they manage), or they have to register themselves? It is not clear why the RMC should pay as they don't store any personal data, but on the other hand have access to all of it, at request.

Any relevant references in the form of web pages would be most welcome?  Half an hour of internet search have not produced anything so far..
Many thanks,
Nic

anselld

Each entity only registers once with the ICO, so if they are registering themselves they should not be charging each and every block they manage.   They should probably not be charging at all unless since it is an overhead cost to the company not a disbursement to do with managing the block.  What does their contract state about recovering costs from the RTM Co?
If they are registering on behalf of the RTM Co then it sounds like they have overstepped the mark as it would be for the RTM Co Directors to decide if they meet the criteria and register themselves.
Having said all that, for £40 is it worth arguing over?

princeofpounds

anselld said:

If the pay are registering on behalf of the RTM Co then it sounds like they have overstepped the mark as it would be for the RTM Co Directors to decide if they meet the criteria and register themselves.

Surely that depends on the terms of their management contract? In any normal trading business I know, the decision to register with the ICO isn't a Board level decision - it's firmly within the purview of executive management. 

OP, you might want to look into the definition of a data processing entity for ICO purposes. You don't have to store data, you just have to process it. I don't know whether you qualify for some other form of exemption but I'm not sure that the get-out clause you think you have really applies.
Personally I think the whole system is a joke, but I don't make the laws...
https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/

sh_kilnao

Thanks for the comments. Yes, probably not worth arguing about if it's just an one-off thing (I hope it is!). No arguing has taken place yet, just mild confusion. The contract with the agents does not go into such specifics, but I guess they classify it under misc. costs, as that has been practice so far - for instance the RTM is billed for any Companies House expenses (as small as they are), and any similar admin costs. I agree, someone could probably argue that besides the agents, the RTM also processes all personal data of all leaseholders, so perhaps just best to pay it up to be on the safe side. Just thought there are some clear guidelines about this case, as this way there could be plenty of extra fees all around that are not strictly necessary! 

bucksbloke

It depends who the controller is. If the RTM Co is the data controller, they must be registered as such and therefore the charge would be justified. 

sh_kilnao

bucksbloke said:

It depends who the controller is. If the RTM Co is the data controller, they must be registered as such and therefore the charge would be justified. 

The RTM never registered nor was assigned a data controller role, unless it is done automatically somehow (and not made known to the board). The agents however, have circulated a GDPR privacy notice declaring: "The personal data about you that we collect, hold and process is of a limited nature and consists of the following: 1. Contact information: names, addresses, telephone numbers, email addresses. 2. Account information connected with the rent or service charge due for the individual property, including debit and credit information and balances. We hold and process this data on what the General Data Protection Regulation (GDPR) terms a ‘legitimate interests’ basis. According to Article 6 (1) (f) of GDPR, “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden ...etc."
It does not say they are the controllers, but they refer to "the controller" as it could be the clients, ie. RTM.

oldbikebloke

sh_kilnao said:

Thanks for the comments. Yes, probably not worth arguing about if it's just an one-off thing (I hope it is!). 

ICO fees are an annual charge, so not one off in that sense