A window on the world of data con-tricks

'If you receive a demand for more than £35 to register under the DPA, this will be a scam'

My husband recently acquired a small double-glazing firm, operating as a sole trader. Just before we went on holiday, we received a form in an official-looking brown envelope from a company called Data Collection Services. It said its records showed we hadn't registered the new business under the Data Protection Act, and that failure to do so was a criminal offence.

The letter also stated that "an offender is liable to a maximum fine not exceeding level five on the criminal justice scale", and that this could be as much as £5,000. So we filled in the form and returned it with £95, which we were informed was the necessary fee.

On speaking to a friend, it would appear that there was no need to pay more than £35. To make matters worse, I contacted the Data Protection Agency's helpline only to be told that my husband's business doesn't even have to be registered. The man I spoke to said around 30 companies provide this sort of "service", preying on the tendency of most people to respond to official-looking envelopes. He also said that some of these companies have had injunctions taken out against them, but that new ones are being set up all the time.

Our cheque, of course, was cashed promptly, making it a nice little earner for this firm.
SB, Kent

Unfortunately, you have been the victim of a common data protection scam that costs British business thousands of pounds a year.

The 1988 Data Protection Act (DPA) regulates the processing of information relating to individuals. Businesses holding personal data are required to register under the Act or face a fine.

Bogus agencies take advantage of this by sending out notices demanding money to register under the DPA. The Information Commissioner's Office (ICO) currently receives more than 2,000 calls a month from businesses, concerning fake data protection agencies posing as government bodies.

The letters request sums of between £95 and £135 to register under the DPA, often using threatening language and on official-looking notepaper. The letter you received certainly appears quite threatening.

The statutory fee for notification is just £35 a year, on which no VAT is payable, as you have since discovered.

The Information Commissioner (IC) is the only statutory authority concerned with DPA registration, and businesses that do need to register should apply directly to the ICO and not through any of these bogus companies.

"The golden rule is that if you receive a letter out of the blue demanding more than £35 to register under the DPA, this will be a scam," warns Phil Jones, the Assistant Information Commissioner. "Our simple message to businesses is to throw the letter in the bin."

Genuine correspondence from the ICO always bears the authority's address - Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If this does not appear on the letter, it is likely to be bogus.

The number of businesses being caught out is falling as public awareness is raised, but the bogus agencies are still a huge problem. To make matters worse, the IC doesn't have the power to do anything about them, although he is looking at ways in which he might take legal action.

The Office of Fair Trading is well aware of the scam, and investigations are continuing. It has already received complaints from other consumers about Data Collection Services, the company that contacted you.

As well as paying over the odds, you have correctly realised that you may not have needed to register your husband's business under the DPA in the first place. It is always worth checking this before parting with any cash; anyone who is unsure whether they need to register should contact the ICO for advice (see below).

Most companies that hold personal data are required to register. However, certain exemptions exist for companies that only process personal data for staff administration, accounts, advertising, marketing and public relations. The IC is required to maintain a public register of those who have notified him under the DPA.

Contact: the ICO notification line on 01625 545740 or www.informationcommissioner.gov.uk

If you need help from our consumer champion, write to Sindie at The Independent on Sunday, Independent House, 191 Marsh Wall, London E14 9RS or email sindie@independent.co.uk. We cannot return documents, give personal replies or guarantee to answer letters. We accept no legal responsibility for advice given.