Levy Collection Agents Guidance

Summary

This guidance explains the optional Levy Collection Agent (LCA) route introduced in January 2021, under which certain GFSC-regulated organisations can register with the ODPA to pay the annual data protection levy on behalf of other controllers or processors. It covers who can become an LCA, what an LCA and their clients must do, and the required Certificate of Exemption.

• Eligibility to be an LCA: Only organisations registered with and/or regulated by the Guernsey Financial Services Commission (GFSC) can register as an ODPA Levy Collection Agent.
• LCA process: During Q4 each year, prepare Certificates of Exemption for clients as at 31 December; in January-February of the following year, file the ODPA annual return declaring the number of controllers/processors covered and pay the aggregate fee (own fee plus each client's fee); then issue Certificates of Exemption to clients.
• Record keeping: LCAs must maintain accurate records of each controller/processor served, including their name, a copy of the Certificate of Exemption issued, and the date it was provided, retained for 6 years.
• Liability: An LCA bears no legal liability for the data protection compliance of the entities it pays the levy for; that responsibility remains with the controller or processor at all times.
• New or newly incorporated clients: Entities newly incorporated during the year generally need not register until the following year unless they answer yes to any of four questions (50+ FTE staff, legal requirement to appoint a DPO, acting as an LCA themselves, or being a non-profit), in which case a stand-alone ODPA registration is required and they cannot be added to the LCA's aggregate figure.
• Ineligible clients: An LCA cannot pay the levy on behalf of any controller or processor that answers yes to any of the four disqualifying questions above; such entities must register separately with the ODPA.
• Certificate of Exemption: Must be issued by the LCA to each client, evidencing that the levy has been paid on their behalf, and must be presented to the ODPA upon request; a template and required minimum content are provided.

Using an LCA does not transfer legal responsibility or liability for data protection compliance, which remains with the controller or processor at all times; the ODPA will communicate directly with that entity, not the LCA, regarding any compliance queries or complaints.

Key obligations

• LCAs must, during quarter 4 of each year, prepare Certificates of Exemption for all controllers or processors they will act for as at 31 December of that year.
• LCAs must, in January to February of the following year, file their ODPA annual return declaring the number of controllers or processors held under valid agreements as at 31 December of the previous year.
• LCAs must pay the ODPA an aggregate sum comprising their own fee plus the relevant fee for each controller or processor they represent.
• LCAs must issue a Certificate of Exemption to each controller or processor they act for, and produce it to the ODPA upon request.
• LCAs must maintain up to date and accurate records (name of each controller/processor, copy of Certificate of Exemption issued, and date provided) and retain these records for 6 years.
• Controllers or processors that answer yes to any of the four disqualifying questions (50+ FTE staff, statutory requirement to appoint a DPO, acting as an LCA, or being a non-profit) must complete a stand-alone registration with the ODPA rather than being added to an LCA's aggregate figure.
• A controller or processor using an LCA retains full legal responsibility and liability for data protection compliance despite the LCA paying its levy.

Applies to

Levy Collection Agents (LCAs), controllers, processors, organisations registered with and/or regulated by the Guernsey Financial Services Commission (licensed fiduciaries, licensed institutions, licensed insurers, licensed insurance intermediaries/managers, registered non-regulated financial services businesses, licensed controlled investment businesses)

Deadlines

• during quarter 4 of any given year: LCAs should start drafting Certificates of Exemption for all controllers or processors they will look after as at 31 December of that year.
• January to February of the subsequent year: LCAs must complete their ODPA annual return, declare the number of controllers/processors covered, pay the aggregate levy, and issue Certificates of Exemption.
• 6 years: LCAs must retain records relating to each controller or processor they pay the levy for.