The dataprotection commissioner has issued a revision of the regulations.
These are the main points.
1. Deadline for notification of electronic records has been extended to July 14th 2004.
2. Self-employed doctors who do not employ any other person with them still have to register if they keep electronic records, but DO NOT have to pay the notification fee.
3. Doctors who have already payed are entitled to a refund.
REVISED FEE STRUCTURE OF THE DATA PROTECTION ACT
The Ministry for Information Technology and Investment would like to announce that, following advice it has received from the Data Protection Commissioner, Government has decided to review the fee structure of the Data Protection Act as well as to extend and simplify the notification process.
The first amendment provides that the first period for notification and annual payment shall be of one year instead of nine months. Therefore the period for notification to the Commissioner has been extended from the 15th April 2004 (next Thursday) to the 14th July 2004 and the notification fee shall be for one year. This should enable persons who were till now "unaware" of the impending deadline to come into line with the law.
Following a thorough review of the Commission’s budget, a radical revision of the fee structure has been carried out. The tariff – previously based on the number of employees and varying from Lm 20 to Lm 1000 per year – has been changed to a flat fee of Lm 10 for all employers (independently of the number of persons employed) and no charge for persons who work on their own and therefore have no employees.
From a review of the latest available data supplied by the Office of the Data Protection Commissioner, it is evident that over 90% of firms and companies who fall under the Data Protection Act do not employ more than 5 persons each. Consequently, there is no reason why the fee structure should be based on employee numbers.
Moreover, since the original regulations were introduced only nine months ago, it is only fair that the new improved fee structure should be applied retroactively. Consequently, any payments made under the old fee structure will be reviewed in line with the new lower fees and the Data Protection Commissioner will be refunding the resulting difference.
Finally, certain exemptions from payment are being introduced. While the obligation for the notification of personal data according to law will be retained, the following shall be exempted from the annual payment of Lm10 -
(a) any person carrying out an economic activity, including any trade, business or profession, as a self-employed person, but who does not employ with him any other person;
(b) the following organisations which are also exempt from the payment of income tax –
trade unions; and
political parties and clubs.
The revision also contemplates the simplification of the process of notification to the Commissioner. Therefore with effect from the 15th July 2003, those companies who only process the personal data contained in their Memorandum and Articles of Association as filed with the Registrar of Companies will not be required to notify the processing. When this status is changed they will be immediately required to notify and pay the fee.
Having submitted the first notification, which will comprise all processing operations till that date, the controller of personal data will have an obligation to notify the Commissioner, either personally or through the personal data representative, before processing new operations or before amending existing processes. Therefore the notification form will not be required annually; only the payment of Lm10 will have to be submitted annually on a notice sent by the Commissioner. The existing form shall only be used in the case of a first notification.
Those persons who have not yet submitted the notification form and who are exempted from the payment of the fee, shall, when submitting the form, state in writing why they are so exempted.
DOI – 13.04.2004