On 9 June 2021, the Information Commissioner issued a Fixed Penalty Notice of £600 against COS Systems Ltd for failure to pay its annual £60 charge to the Commissioner under the Data Protection Act 2018 and the Data Protection (Charges and Information) Regulations 2018. COS Systems appealed the Fixed Penalty Notice.

The date of the charge period was 8 September 2020, but the Commissioner had allowed until 25 May 2021 for the payment to be made. There was no dispute that this was the relevant date, or that the applicable charge was £60 for a tier 2 controller, such as COS Systems.

The Commissioner sent two reminders by post to COS Systems to the address listed on the Commissioner’s register, as well as an email, confirming that the registration had expired and requesting payment of the £60 charge within 14 days.

On 4 May 2021, the Commissioner sent a Notice of Intent by post with a covering letter, giving COS Systems until 25 May 2021 to pay the charge of £60 or make representations. COS Systems did neither. The Commissioner therefore issued the Penalty Notice on 9 June 2021.

COS Systems said that it had received the Penalty Notice, but that it did not receive any other communications, including the Notice of Intent, because there were no staff in its office due to a combination of furlough and working from home.

The Tribunal found that the Notice of Intent was given to COS Systems in accordance with the 2018 Act because it was sent to the correct address, which COS Systems had not said was incorrect. It had also not provided any evidence or explanation as to why it might not have been received at its registered office.

The Tribunal said that, given the reminders sent by the Commissioner, COS Systems should not have been unaware of its obligations. The Tribunal accepted that many businesses were in serious difficulties at the start of the pandemic, when offices were suddenly closed, and staff sent home or put on furlough. There was a period during which it may have been reasonable for a small business to fail to deal with post sent to its office. However, the Notice of Intent was sent more than a year after the first country-wide lockdown in March 2020. Any reasonably conscientious business-owner would have put mechanisms in place by this time in the pandemic to deal with incoming post relating to business and regulatory matters, and any associated legal obligations. COS Systems had not explained what, if any, arrangements were in place to deal with its post at this time. There was no explanation from COS Systems as to why it received the Penalty Notice, but not the Notice of Intent.

The Tribunal therefore found that COS Systems did not have a reasonable excuse for failing to pay the £60 charge and the Commissioner’s decision to impose a fixed penalty of £600 was in accordance with the law. The appeal was dismissed. (COS Systems Ltd v Information Commissioner [2021] UKFTT 2021_0151 (GRC) (13 December 2021) — to read the judgment in full, click here).