|
- Lm10 flat fee substitutes former rates
By Matthew Vella
The Data Protection Commission has drastically scaled down notification fees for the processing of personal data by businesses, sole-traders, professionals and NGOs, following escalating criticism on the lack of consultation ahead of the deadline to pay the fee, which was due to expire this week.
Recently employers and business associations called for a revision of the fees after business owners and employers complained on the compliance costs. Many pointed to the lack of consultation with the private business sector, a factor that was recently highlighted over the recent controversy of new smoking laws banning smoking in public spaces, including bars and restaurants. The Malta Chamber of Commerce and Enterprise, the Malta Employers Association, the Malta Federation of Industry and the Malta Hotels and Restaurants Association also met Data Protection Commissioner Paul Mifsud Cremona to express their concern at the level of fees chargeable.
“Following a thorough review of the Commission’s budget, a radical revision of the fee structure has been carried out,” the Ministry for Information Technology and Investment announced this week, saying the tariff which previously varying from Lm 20 to Lm 1000 per year based on the number of employees had been changed to a flat fee of Lm 10 for all employers, independently of the number of persons employed.
In its backtrack over the fees, the Data Protection Commission has also set itself yet another administrative burden since it will be refunding those entities and persons which have already paid the notification fee.
Additionally, other entities have been exempted from the annual payment of Lm10, including self-employed who do not employ any workers, and those organisations which are exempt from income tax, namely: philanthropic institutions; band clubs; sports clubs; trade unions; and political parties and clubs.
“From a review of the latest available data supplied by the Data Protection Commission, it is evident that over 90 per cent of firms and companies falling under the Data Protection Act do not employ more than five persons each. Consequently, there is no reason why the fee structure should be based on employee numbers,” the Ministry said.
The period for notification and annual payment has also been extended to one year instead of nine months, which means the deadline for notification has been extended from 15 April 2004 to 14 July 2004, and the notification fee shall be for one year. “This should enable persons who were till now ‘unaware’ of the impending deadline to come into line with the law,” the Ministry said.
The revision also contemplates the simplification of the process of notification to the Commissioner. With effect form 15 July 2003, those companies who only process the personal data contained in their Memorandum and Articles of Association as filed with the Registrar of Companies will not be required to notify the processing. When this status is changed they will be immediately required to notify and pay the fee.
Having submitted the first notification, which will comprise all processing operations till that date, the controller of personal data – the employer or company director – will have an obligation to notify the Commissioner, either personally or through the personal data representative, before processing new operations or before amending existing processes. Therefore the notification form will not be required annually and only the payment of Lm10 will have to be submitted annually on a notice sent by the Commissioner. The existing form shall only be used in the case of a first notification.
Those persons who have not yet submitted the notification form ad who are exempted from the payment of the fee, shall, when submitting the form state in writing why they are so exempted.
|
