Making You Count The Institute of Certified Bookkeepers
Making you count Login 

Welcome to the Institute of Certified Bookkeepers UK forum

New to the forum? See our Getting Started Guide

Search the forum here

Latest Topic Updates

 

ICB Main Site -> Forum Home -> General chat-room -> Data protection
Data protection
Fri 04 May 2012 08:49 PM
accounting-4

accounting-4

Associate CB.Dip PM.Dip
Practice Licence


23 posts
Question-as we have to complete ML information about all our clients we are technically passing personal information to 3rd parties-does this mean every MIP should be registered with the ICO?
I personally am registered but just wondered if it applies ?  
 
 
 
Fri 04 May 2012 09:13 PM
MM Bookkeeping
Member CB.Dip PM.Dip
Practice Licence


290 posts
Hi,

I am registered with ICO and they advised that if you are keeping any data whether on computer or paper about any individual you do work for then you must register. So therefore I would say the answer to your question is Yes.
 
 
 
 
Fri 04 May 2012 09:22 PM
accounting-4

accounting-4

Associate CB.Dip PM.Dip
Practice Licence


23 posts
You only have to register if you pass information to a 3rd party, if you keep personal information but do not pass it on to anyone then all you have to do is adhere to the principles of the act  
 
 
Fri 04 May 2012 09:44 PM
MM Bookkeeping
Member CB.Dip PM.Dip
Practice Licence


290 posts
Hi again,


If you go to ICO website you will see that accountants which includes bookkeepers are required to register with ICO.

If you are only working on clients premises then you are classed as a Data Processor and not a Data Controller and do not need to register. 
As all my work is done at my office on my PCs and I retain employee information etc then there is a requirement to register.    
 
 
 
Tue 08 May 2012 09:15 PM
Mac
Student


121 posts

Hi -

This question of notification to the Information Commissioner’s Office and registration under the Data Protection Act is particularly fraught.  Admittedly there must be few bookkeepers who don‘t use accounting systems, email, Word, etc, but registration applies only to processing personal data by computer (or other automated means).  

If you use only paper records for personal information and process it all manually, generally you do not have to register.  You can check it out in the ICO’s online self-assessment.

You are right that the registration requirement can apply if you disclose personal information to third parties.  It can also arise from using personal data in other ways, editing, storing or retrieving the data.  The ICO’s website says 'The Data Protection Act 1998 requires every organisation processing personal data to notify with the ICO, unless they are exempt', but this is not completely true.  It is correct only for computer/automated processing and for businesses and other organisations that are data controllers.  

The Act itself and the ICO‘s guides on the definition of a ‘data controller‘ do not actually differentiate between processing carried out on your client’s premises or your own.  

This is a really crucial point for two reasons: only data controllers can notify the ICO for registration, while others (‘data processors’) are outside the direct scope of the Act anyway.  

I hope this helps.


Mac


PS  I have a law degree and have studied the DPA.  This posting is based on the Act itself and information on the ICO‘s website but it should not be interpreted as giving specific professional advice.

______________________
Mac

West London
 
 
 
Wed 09 May 2012 09:54 AM
accounting-4

accounting-4

Associate CB.Dip PM.Dip
Practice Licence


23 posts

MM Bookkeeping- This is what the ICB say about it and as you will see it does not say every member must register -it only says you must comply with the Act and only if you are passing information on you need to register with the ICO

" The Data Protection Act gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly.

The Act works in two ways. Firstly, it states that anyone who processes personal information must comply with eight principles, which make sure that personal information is:

  • Fairly and lawfully processed
  • Processed for limited purposes
  • Adequate, relevant and not excessive
  • Accurate and up to date
  • Not kept for longer than is necessary
  • Processed in line with your rights
  • Secure
  • Not transferred to other countries without adequate protection

The second area covered by the Act provides individuals with important rights, including the right to find out what personal information is held on computer and most paper records.

Should an individual or organisation feel they're being denied access to personal information they're entitled to, or feel their information has not been handled according to the eight principles, they can contact the Information Commissioner's Office for help. Complaints are usually dealt with informally, but if this isn't possible, enforcement action can be taken.

If you hold and process information about your clients, employees or suppliers, you'll need to comply with the Data Protection Act. This states that personal information must be kept secure, up to date and processed lawfully and fairly.

In the event that you process personal information and pass it to third parties then you must NOTIFY the ICO and pay an annual fee of £35.00 and comply with the Data Protection Act."

And Mac thank you for the clarification but I do believe we should all register just because we are passing all our client information on to the ICB through the MLRs
 
 

 
 
 
Wed 06 Jun 2012 09:57 AM
Mac
Student


121 posts

accounting-4
said:
This is what the ICB say about it - . . . . only if you are passing information on you need to register with the ICO . . . . . .

I do believe we should all register just because we are passing all our client information on to the ICB through the MLRs.



Thank you for this info from the ICB; it answers one or two of the questions but parts of it are not what the Data Protection Act says.  For example, it would be incorrect to think the DPA requires registration only if you disclose information to third parties.  

I read the ICB’s professional conduct regulations which say quite simply that members in practice must ‘comply at all times with the requirements of the Data Protection Act . . . .‘

The Information Commissioner’s website says it is mandatory to notify the ICO if you are a data controller and you process personal data ‘in an automated form’ (e.g. using a computer), unless you are exempt from registration under the Act.

However, the ICB seems to go further because, as you said earlier, licensed members are obliged to use AML Online or paper MLR 8 forms to send annual reports to the ICB.  The ICB says you must notify the ICO if you ‘process personal information and pass it to third parties‘, which seems to mean everyone with an ICB practice license, irrespective of any exemptions in the Act.

Clients might not normally expect personal information about themselves to be disclosed by their bookkeepers to third parties so, if it isn’t in the terms of engagement already, it may be best to include this specifically.  Does anyone have reference to this in their letters of engagement?



Cheers


(Apologies for not replying sooner owing to problems with the forum maintenance.)



______________________
Mac

West London
 
 
First Previous - Page 1 of 1 - Next Last

Posts on this forum are not the views or opinion of the ICB unless stated
The ICB reserves the right to moderate or remove any posts made on this forum
Any abusive posts or users should be reported to memberservices@bookkeepers.org.uk

By using this forum you are agreeing to abide by the full Forum Terms and Conditions viewable here

 






© The Institute of Certified Bookkeepers