DATA PROTECTION ACT 2018

• (g) examine the lawfulness of processing pursuant to section 95 and inform the data subject within a reasonable period of the outcome of the examination or of the reasons why the examination has not been carried out,

• (h) cooperate with, and provide mutual assistance to, other supervisory authorities in accordance with section 103 and Chapter VII of the Directive with a view to ensuring consistent application and enforcement of the Directive,

• (i) conduct, of its own volition or on the basis of information received from another supervisory authority or other public authority, investigations, in accordance with Part 6, on the application of this Part,

( j) monitor relevant developments insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies,

• (k) provide advice to a controller or processor, as the case may be, pursuant to section 84, and

• (l) contribute to the activities of the European Data Protection Board.

• (2) The Commission shall not be competent for the supervision of data processing operations of the courts when acting in their judicial capacity.

• (3) Subject to subsections (4) and (5), the Commission shall not charge a data subject or data protection officer a fee in respect of the performance by it of its functions under this section.

• (4) Where a request referred to in Article 46(4) of the Directive is manifestly unfounded or excessive, the Commission may—

• (a) charge the person who made the request a reasonable fee, based on its administrative costs, or

• (b) refuse to act on the request.

• (5) It shall be for the Commission to demonstrate that a request referred to in subsection (4) is manifestly unfounded or excessive.

• (6) In this section, “excessive” includes, in particular, repetitive.

• (7) For the purposes of this section, a request is repetitive where it is substantially the same as a request previously made by or on behalf of the same person and dealt with under this Part.

102. Power of the Commission to advise and issue opinions

102. The Commission shall have the power to issue opinions on matters related to the protection of personal data to—

• (a) on its own initiative or on request by the body concerned, the Houses of the Oire-achtas, Government, public authorities and bodies, and

• (b) on its own initiative, the public.

103. Mutual assistance

103. (1) The Commission shall, for the purposes referred to in section 101(1)(h)—

• (a) in accordance with this Chapter, provide other supervisory authorities with mutual assistance, and

• (b) put in place measures for effective cooperation with those authorities.

• (2) The Commission, on receipt by it of a request of another supervisory authority (“requesting supervisory authority”) shall—

• (a) without undue delay and no later than one month after receiving the request, take all appropriate measures required to reply to the request, and

• (b) inform the requesting supervisory authority of the results of, or progress made in response to, the request.

• (3) The measures referred to in subsection (2)(a) include the exercise by the Commission of its powers under Chapters 3, 4 and 5 of Part 6.

• (4)
• (a) The Commission shall not refuse to comply with a request unless—

• (i) it is not responsible under the Directive for the subject matter of the request or for the measures it is requested to carry out, or

• (ii) compliance with the request would infringe the law of the State or European Union.

• (b) The Commission shall provide the requesting supervisory authority concerned with the reasons for its refusal under paragraph (a) to comply with a request.

• (5) The Commission, where providing information to a requesting supervisory authority in response to a request, shall, insofar as practicable, and in accordance with any imple-menting acts to which Article 50(8) of the Directive apply, do so—

• (a) by electronic means, and

• (b) using a standardised format, if any.

• (6) Without prejudice to subsection (7), the Commission shall not charge a fee for any action taken in response to a request for mutual assistance.

• (7) The Commission may enter into an agreement with other supervisory authorities on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.

• (8) In this section and section 104—

“mutual assistance” includes—

• (a) responding to requests for information, and

• (b) undertaking supervisory measures, such as the carrying out of inspections or invest-igations under Part 6 or consultations;

“request” means a request for mutual assistance referred to in Article 50 of the Directive.

104. Requests by Commission for mutual assistance

104. (1) A request by the Commission to another supervisory authority shall contain all the information necessary for the purpose of the request, which shall include the purpose of and reasons for the request.

• (2) The Commission shall use information received by it from another supervisory authority in response to a request only for the purpose for which it was requested.

PART 6 Enforcement of Data Protection Regulation and Directive

Chapter 1 Preliminary

105. Interpretation (Part 6)

105. (1) In this Part—

“complaint” means a complaint within the meaning of Chapter 2 or 3;

“investigation” means an investigation under Chapter 5;

“investigation report” has the meaning assigned to it by section 139;

“relevant enactment” means—

• (a) the Data Protection Regulation, or

• (b) a provision of this Act, or a regulation under this Act, that gives further effect to the Data Protection Regulation;

“relevant provision” means a provision of this Act, or a regulation under this Act, that gives effect to the Directive.

• (2) A reference in this Part (other than in Chapter 2) to a controller or a processor includes a reference to a controller or a processor, as the case may be, within the meaning of Part 5.

• (3) Where a person is a controller by virtue of his or her being the subject of a designation under subsection (1) or (2) of section 3—

• (a) a reference in sections 117, 128 and 135(10) to a controller shall be deemed to be a reference to the appropriate authority that, or the Minister who, made the designa-tion, and not to the person, and

• (b) a reference in sections 132(6) and 133(10) to a controller shall be deemed not to include a reference to the person.

• (4) A reference in this Part to information obtained in an inquiry (within the meaning of section 110 or 123) shall be construed as including, where applicable—

• (a) an investigation report prepared in the course of the inquiry, and any submissions annexed to the report, and

• (b) any additional information obtained, in the course of the inquiry, by the Commission under section 140(2).

106. Service of documents (Part 6)

106. (1) Subject to section 116(4)(a), a notice or other document that is required to be served on or given to a person under this Part shall be addressed to the person concerned by name and shall be so served on or given to the person in one of the following ways:

• (a) by delivering it to the person;

• (b) by leaving it at the address at which the person ordinarily resides or carries on business or, in a case in which an address for service has been furnished, at that address;

• (c) by sending it by post in a prepaid registered letter or by any other form of recorded delivery service to the address referred to in paragraph (b); or

• (d) by electronic means, in a case in which the person has given notice in writing to the person serving or giving the notice or document concerned of his or her consent to the notice or document (or notices or documents of a class to which the notice or document belongs) being served on, or given to, him or her in that manner.

• (2) For the purposes of this section, a company within the meaning of the Act of 2014 is deemed to be ordinarily resident at its registered office, and every other body corporate and every unincorporated body of persons shall be deemed to be ordinarily resident at its principal office or place of business.

Chapter 2 Enforcement of Data Protection Regulation

107. Interpretation (Chapter 2)

107. In this Chapter—

“complainant” means a data subject who lodges a complaint or, as the case may be, a not-for-profit body, organisation or association that, in accordance with Article 80(1), lodges a complaint on behalf of a data subject;

“complaint” means a complaint lodged pursuant to Article 77(1) or in accordance with Article 80(1), and shall be deemed to include a complaint so lodged by or on behalf of a data subject where—

• (a) the data subject considers that the processing of personal data relating to him or her infringes a relevant enactment, and

• (b) the Commission is the competent supervisory authority in respect of the complaint;

“corrective power” means a power conferred by Article 58(2) of the Data Protection Regulation;

“infringement” means an infringement of a relevant enactment;

“inquiry” means an inquiry referred to in section 110(1).

108. Complaints under Chapter 2: General

108. (1) Where a complaint is lodged with the Commission, the Commission shall, as soon as practicable, give the complainant concerned a notice in writing acknowledging the lodging of the complaint, and informing the complainant of—

• (a) where the Commission is the competent supervisory authority in respect of the complaint, the complainant’s right under section 150(5) and (7), and

• (b) where a supervisory authority other than the Commission is the competent supervisory authority in respect of the complaint, the complainant’s right to a judicial remedy against that competent supervisory authority where it does not—

• (i) handle the complaint, or

• (ii) inform the complainant within 3 months from the date on which the complaint is received by that authority on the progress or outcome of the complaint.

• (2) Where the Commission is the competent supervisory authority in respect of a complaint, it shall—

• (a) handle the complaint in accordance with this Part, and

• (b) inform the complainant, within 3 months from the date on which the complaint is received by the Commission, on the progress or outcome of the complaint.

• (3) For the purposes of subsection (2)(b), the Commission shall be taken to have informed a complainant of the outcome of the complaint concerned where it gives the complainant a notice under section 109(6) or, as the case may be, section 116.

109. Commission to handle complaint under Chapter 2

109. (1) For the purposes of section 108(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.

• (2) The Commission, where it considers that there is a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject

matter of the complaint, may take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.

• (3) Where the parties concerned reach an amicable resolution of the subject matter of the complaint, the complaint shall, from the date on which the amicable resolution is reached, be deemed to have been withdrawn by the complainant concerned.

• (4) Where the Commission considers that an amicable resolution cannot be reached by the parties within a reasonable time, it shall proceed—

• (a) in the case of a complaint to which section 113 applies, to comply with section 113(2), or

• (b) in the case of any other complaint, to take an action specified in subsection (5).

• (5) The actions referred to in subsection (4)(b) include one or more than one of the following:

• (a) rejection of the complaint;

• (b) dismissal of the complaint;

• (c) provision to the complainant of advice in relation to the subject matter of the complaint;

• (d) serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following:

• (i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment;

• (ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

• (iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

• F15[(da) where the Commission considers the processing of personal data the subject of the complaint infringes a relevant enactment, issuing a reprimand to the controller or processor concerned;]

• (e) causing of such inquiry as the Commission thinks fit to be conducted in respect of the complaint;

• (f) taking of such other action in respect of the complaint as the Commission considers appropriate.

• (6) The Commission shall, as soon as practicable after taking an action referred to in subsection (5) (other than paragraph (e) of that subsection), give the complainant a notice in writing informing the complainant of the action taken.

110. Commission may conduct inquiry into suspected infringement of relevant enactment

110. (1) The Commission, whether for the purpose of section 109(5)(e), section 113(2), or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.

• (2) The Commission may, for the purposes of subsection (1), where it considers it appropriate to do so, in particular do either or both of the following:

• (a) cause any of its powers under Chapter 4 (other than section 135) to be exercised;

• (b) cause an investigation under Chapter 5 to be carried out.

111. Decision of Commission where inquiry under Chapter 2 conducted of own volition

111. (1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall—

• (a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

• (b) if not so satisfied, make a decision to that effect.

• (2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

• (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

• (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

• (3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

112. Decision of Commission where inquiry conducted in respect of complaint to which Article 55 or 56(5) applies

112. (1) Where an inquiry has been conducted in respect of a complaint in respect of which the Commission is the competent supervisory authority under Article 55 or 56(5), the Commission, having considered the information obtained in the examination, may—

• (a) if satisfied that an infringement by the controller or processor to which the complaint relates has occurred or is occurring, make a decision to that effect, or

• (b) if not so satisfied, make a decision to dismiss the complaint.

• (2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

• (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

• (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

• (3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

113. Complaint to which Article 60 applies

113. (1) This section applies to a complaint in respect of which the Commission is the lead supervisory authority.

• (2) Where section 109(4)(a) applies, the Commission shall—

• (a) in accordance with subsection (3), make a draft decision in respect of the complaint (or, as the case may be, part of the complaint) and, where applicable, as to the envisaged action to be taken in relation to the controller or processor concerned, and

• (b) in accordance with Article 60 and, where appropriate, Article 65, adopt its decision in respect of the complaint or, as the case may be, part of the complaint.

• (3) In making a draft decision under subsection (2)(a), the Commission shall, where applicable, have regard to—

• (a) the information obtained by the Commission in its examination of the complaint, including, where an inquiry has been conducted in respect of the complaint, the information obtained in the inquiry, and

• (b) any draft for a decision that is submitted to the Commission by a supervisory authority in accordance with Article 56(4).

• (4) Where the Commission adopts a decision under subsection (2)(b) to the effect that an infringement by the controller or processor concerned has occurred or is occurring, it shall, in addition, make a decision—

• (a) where an inquiry has been conducted in respect of the complaint—

• (i) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

• (ii) where it decides to so exercise a corrective power, the corrective power that is to be exercised,

or

• (b) where an inquiry has not been conducted in respect of the complaint—

• (i) as to whether an action specified in subsection (6) should be taken in respect of the controller or processor concerned, and

• (ii) where it decides to take such an action, the action that is to be taken.

• (5) The Commission, in making its decision under subsection (4), shall have due regard to the decision as to the envisaged action to be taken in relation to the controller or processor included in the Commission’s draft decision under subsection (2)(a) or, as the case may be, its revised draft decision under Article 60.

• (6) The actions referred to in subsection (4)(b) include F16[any or all] of the following:

• (a) the serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following:

• (i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment;

• (ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

• (iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

• F17[(aa) the issuing of a reprimand to the controller or processor concerned;]

• (b) the taking of such other action in respect of the complaint as the Commission considers appropriate.

• (7) The Commission—

• (a) where it makes a decision referred to in subsection (4)(a)(ii), shall exercise the corrective power concerned, and

• (b) where it makes a decision referred to in subsection (4)(b)(ii), shall take the action concerned.

114. Commission to adopt decision in certain circumstances

114. Where—

• (a) a complaint is lodged with the Commission, or a complaint is lodged with another supervisory authority and the Commission is the supervisory authority in respect of the complainant concerned,

• (b) another supervisory authority is the lead supervisory authority in respect of the complaint, and

• (c) a decision is made, in accordance with Article 60, to dismiss or reject the complaint or, where Article 60(9) applies, part of the complaint,

the Commission shall adopt the decision referred to in paragraph (c) in respect of the complaint or, as the case may be, part of the complaint.

115. Exercise by Commission of corrective power

115. (1) For the purposes of exercising a corrective power under section 111, 112 or 113, the Commission may do either or both of the following:

• (a) subject to Chapter 6, decide to impose an administrative fine on the controller or processor concerned;

• (b) exercise any other corrective power specified in Article 58(2).

• (2) Without prejudice to the generality of subsection (1)(b), the Commission may, for the purposes of exercising a power referred to in that provision, serve on the controller or processor concerned an enforcement notice requiring it to take such steps as the Commission considers necessary for those purposes.

116. Notification of decision of Commission under Chapter 2

116. (1) The Commission shall—

• (a) as soon as practicable after it makes a decision under section 111 or 112, give the controller or processor concerned a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has decided to exercise in respect of the controller or processor,

and

• (b) in the case of a decision under section 112, and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has decided to exercise in respect of the controller or processor.

• (2) Subject to subsection (4), the Commission shall—

• (a) as soon as practicable after it adopts a decision under section 113(2)(b), give the controller or processor concerned a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor,

and

• (b) in the case of a complaint lodged with the Commission, and as soon as practicable after the giving of the notice under paragraph (a), give the complainant concerned a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take, in respect of the controller or processor.

• (3) The Commission shall, as soon as practicable after it adopts a decision under section 114, give—

• (a) the complainant concerned, and

• (b) the controller or processor concerned,

a notice in writing informing them of the rejection or dismissal of the complaint or, as the case may be, the part of the complaint.

• (4) Where the Commission is the lead supervisory authority in relation to a complaint to which Article 60(9) applies, the Commission shall, as soon as practicable after it adopts its decision under Article 60(9)—

• (a) give the controller or processor concerned, at its main establishment or single establishment, a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take in respect of the controller or processor,

and

• (b) give the complainant concerned a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has decided to exercise or, as the case may be, the action that it has decided to take in respect of the controller or processor.

117. Judicial remedy for infringement of relevant enactment

117. (1) Subject to subsection (9), and without prejudice to any other remedy available to him or her, including his or her right to lodge a complaint, a data subject may, where he or she considers that his or her rights under a relevant enactment have been infringed as a result of the processing of his or her personal data in a manner that fails to comply with a relevant enactment, bring an action (in this section referred to as a “data protection action”) against the controller or processor concerned.

• (2) A data protection action shall be deemed, for the purposes of every enactment and rule of law, to be an action founded on tort.

• F18[(3) The District Court shall, subject to subsections 5A and 6A, and the Circuit Court shall, subject to subsections (5) and (6), concurrently with the High Court, have jurisdiction to hear and determine data protection actions.]

• (4) The court hearing a data protection action shall have the power to grant to the plaintiff one or more than one of the following reliefs:

• (a) relief by way of injunction or declaration; or

• (b) compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment.

• (5) The compensation recoverable in a data protection action in the Circuit Court shall not exceed the amount standing prescribed, for the time being by law, as the limit of that court’s jurisdiction in tort.

• F19[(5A) The compensation recoverable in a data protection action in the District Court shall not exceed the amount standing prescribed, for the time being by law, as the limit of that court’s jurisdiction in tort.]

• (6) The jurisdiction conferred on the Circuit Court by this section may be exercised by the judge of any circuit in which—

• (a) the controller or processor against whom the data protection action is taken has an establishment, or

• (b) the data subject has his or her habitual residence.

• F19[(6A) The jurisdiction conferred on the District Court by this section may be exercised by the judge of any district in which—

• (a) the controller or processor against whom the data protection action is taken has an establishment, or

• (b) the data subject has his or her habitual residence.]

• (7) A data protection action may be brought on behalf of a data subject by a not-for-profit body, organisation or association to which Article 80(1) applies that has been mandated by the data subject to do so.

• (8) The court hearing a data protection action brought by a not-for-profit body, organisation or association under subsection (7) shall have the power to grant to the data subject on whose behalf the action is being brought one or more of the following reliefs:

• (a) relief by way of injunction or declaration; or

• (b) compensation for damage suffered by the plaintiff as a result of the infringement of the relevant enactment.

• (9) A data subject may not bring a data protection action against a controller or processor that is a public authority of another Member State acting in the exercise of its public powers.

• (10) In this section—

“damage” includes material and non-material damage;

“injunction” means—

• (a) an interim injunction,

• (b) an interlocutory injunction, or

• (c) an injunction of indefinite duration.

117A. F20[Judicial remedy for infringement of certain appropriate safeguards on transfers of personal data outside European Union

F21[117A. (1) This section applies to a transfer of personal data by a controller or processor to a third country or an international organisation pursuant to Article 46 where the transfer is subject to appropriate safeguards provided for in the rules or clauses (in this section referred to as “relevant instruments”) set out in subsection (5).

• (2) Without prejudice to any other remedy available to him or her, including his or her right to bring an action under section 117 or to lodge a complaint, a data subject whose personal data is included in a transfer referred to in subsection (1) may, where the transfer is subject to appropriate safeguards set out in a relevant instrument, enforce—

• (a) any rights (whether described as third party beneficiary rights or otherwise) conferred on data subjects by, or any clauses or rules expressed to be for the benefit of data subjects in, the instrument concerned, and

• (b) where that transfer is subject to any additional safeguards conferring rights on data subjects, those rights.

• (3) An action to enforce any rights conferred on data subjects or any clauses or rules expressed to be for the benefit of data subjects referred to in subsection (2)—

• (a) may be taken against—

• (i) a party to the transfer referred to in subsection (1), or

• (ii) a sub-processor of a party referred to in subparagraph (i) in so far as that sub-processor is processing personal data referred to in that subsection,

and

• (b) shall be deemed to be an action founded on contract.

• (4) Subsections (3) to (10) of section 117 shall apply to an action taken by a data subject under this section subject to the following modifications:

• (a) a reference in those subsections to a data protection action shall be taken to be a reference to an action under this section;

• (b) a reference in subsections (5) and (5A) to the limit of that court’s jurisdiction in tort shall be taken to be a reference to the limit of that court’s jurisdiction in contract;

• (c) a reference in subsections (4)(b) and (8)(b) to compensation for damage suffered by the plaintiff as a result of the infringement of a relevant enactment shall be taken to be a reference to compensation for damage suffered by the plaintiff as a result of the infringement of the relevant instrument.

• (5) The relevant instruments are:

• (a) binding corporate rules approved in accordance with Article 47;

• (b) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

• (c) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

• (d) contractual clauses authorised by a supervisory authority pursuant to Article 46(3)(a);

• (e) standard contractual clauses which are the subject of a decision adopted by the Commission in accordance with Article 26(4) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995³ on the protection of individuals with regard to the processing of personal data and on the free movement of such data.]]

Chapter 3 Enforcement of Directive

118. Interpretation (Chapter 3)

118. In this Chapter—

“competent supervisory authority” shall be construed in accordance with the Directive;

“complainant” means a data subject who or, as the case may be, a body mandated in accordance with section 120 that, lodges a complaint;

“complaint” means a complaint lodged in accordance with section 119;

“controller” and “processor” have the meanings they have in Part 5;

“corrective power” means a power conferred on the Commission by section 127;

“inquiry” means an inquiry referred to in section 123;

“infringement” means an infringement of a relevant provision.

119. Data subject may lodge complaint with Commission

119. (1) Without prejudice to any other remedy available to him or her, and subject to section 120, a data subject who considers that processing of his or her personal data

infringes a relevant provision, or provisions adopted by another Member State giving effect to a right to the data subject under the Directive, may lodge a complaint with the Commission.

• (2)
• (a) Without prejudice to the right of a data subject under subsection (1), the Commission may specify the form of a complaint lodged under that subsection.

• (b) When specifying a form under paragraph (a), the Commission shall, without excluding other means of communication, ensure that the form is capable of being completed electronically.

• (3) The Commission, where it is not the competent supervisory authority in respect of a complaint lodged with it under subsection (1), shall—

• (a) without undue delay, transmit the complaint to the competent supervisory authority, and

• (b) inform the data subject of the transmission of the complaint.

• (4) Where a complaint is transmitted to the Commission in accordance with the law of a Member State giving effect to Article 52(2) of the Directive, the complaint shall, for the purposes of this Part, be deemed to be a complaint lodged, on the date on which the complaint is received by the Commission, with the Commission in accordance with subsection (1).

120. Representation of data subjects

120. (1) A data subject may mandate a body, organisation or association to which subsection (2) applies to do either or both of the following on his or her behalf:

• (a) lodge a complaint under section 119;

• (b) exercise the rights referred to in section 128 and section 150.

• (2) This subsection applies to a body, organisation or association—

• (a) that provides its services on a not-for-profit basis,

• (b) that has been properly constituted in accordance with the law of the State or another Member State,

• (c) whose objectives, as specified in the documents establishing the body, organisation or association concerned, are in the public interest, and

• (d) that is active with regard to the protection of data subject rights and freedoms, including protection of their personal data.

• (3) Where the Commission or a court, in performing its functions under this Act, has reas-onable doubts as to whether a particular body, organisation or association is one to which subsection (2) applies, it may request the provision by the body, organisation or association concerned of such additional information as is necessary in order to confirm that it is such a body, organisation or association.

121. Complaints under Chapter 3: General

121. (1) Where a complaint is lodged, or deemed to be lodged, with the Commission under section 119(1), and section 119(3) does not apply to the complaint, the Commission shall as soon as practicable give the complainant concerned a notice—

• (a) acknowledging the lodging of the complaint or, as the case may be, its receipt by the Commission referred to in section 119(4), and

• (b) informing the complainant of the complainant’s rights under section 128.

• (2) Where subsection (1) applies, the Commission shall—

• (a) handle the complaint in accordance with this Part, and

• (b) inform the complainant within 3 months from the date on which the complaint is lodged, of the progress or outcome of the complaint.

• (3) For the purposes of subsection (2)(b), the Commission shall be taken to have informed a complainant of the outcome of the complaint concerned where it gives the complainant a notice under section 122(5) or, as the case may be, section 126.

122. Commission to handle complaint under Chapter 3

122. (1) For the purposes of section 121(2)(a), the Commission shall examine the complaint and shall, in accordance with this section, take such action in respect of it as the Commission, having regard to the nature and circumstances of the complaint, considers appropriate.

• (2) The Commission, where it considers that there is a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject matter of the complaint, may take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.

• (3) Where the parties concerned reach an amicable resolution of the subject matter of the complaint, the complaint shall, from the date on which the amicable resolution is reached, be deemed to have been withdrawn by the complainant concerned.

• (4) Where the Commission considers that an amicable resolution cannot be reached by the parties within a reasonable time, it shall proceed to take one or more than one of the following actions:

• (a) rejection of the complaint;

• (b) dismissal of the complaint;

• (c) provision to the complainant of advice in relation to the subject matter of the complaint;

• (d) serving on the controller or processor concerned of an enforcement notice, requiring it to do one or more than one of the following:

• (i) comply with the data subject’s request to exercise his or her rights under a relevant provision;

• (ii) bring processing into compliance with a relevant provision, in a specified manner and within a specified period;

• (iii) where the enforcement notice is given to the controller, communicate a personal data breach to data subjects;

• F22[(da) where it considers the processing of personal data the subject of the complaint infringes a relevant enactment, the issuing to the controller or processor concerned of a reprimand;]

• (e) causing of such inquiry as the Commission thinks fit to be conducted in respect of the complaint;

• (f) taking of such other action in respect of the complaint as the Commission considers appropriate.

• (5) The Commission shall, as soon as practicable after taking an action referred to in subsection (4) (other than paragraph (e) of that subsection), give the complainant a notice in writing informing the complainant of the action taken.

123. Commission may conduct inquiry into suspected infringements of relevant provision

123. (1) The Commission, whether for the purpose of section 122(4)(e) or of its own volition, may, in order to ascertain whether an infringement has occurred or is occurring, cause such inquiry as it thinks fit to be conducted for that purpose.

• (2) The Commission may, for the purposes of subsection (1), where it considers it appropriate to do so, in particular do either or both of the following:

• (a) cause any of its powers under Chapter 4 (other than sections 134 and 135) to be exercised;

• (b) cause an investigation under Chapter 5 to be carried out.

124. Decision of Commission in respect of inquiry under Chapter 3 conducted of own volition

124. (1) Where an inquiry has been conducted of the Commission’s own volition, the Commission, having considered the information obtained in the inquiry, shall—

• (a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, or

• (b) if not so satisfied, make a decision to that effect.

• (2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

• (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

• (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

• (3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

125. Decision of Commission where inquiry conducted in respect of complaint under Chapter 3

125. (1) Where an inquiry has been conducted in respect of a complaint, the Commission, having considered the information obtained in the inquiry, may—

• (a) if satisfied that an infringement by the controller or processor to which the complaint relates has occurred or is occurring, make a decision to that effect, or

• (b) if not so satisfied, make a decision to dismiss the complaint.

• (2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, make a decision—

• (a) as to whether a corrective power should be exercised in respect of the controller or processor concerned, and

• (b) where it decides to so exercise a corrective power, the corrective power that is to be exercised.

• (3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

126. Notification of decision of Commission under Chapter 3

126. The Commission shall—

• (a) as soon as practicable after the decision under section 124 or 125 is made by it, give the controller or processor concerned a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor,

and

• (b) in the case of a decision under section 125, give, as soon as practicable after the notice under paragraph (a) is given, the complainant a notice in writing setting out—

• (i) the decision and the reasons for it, and

• (ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor.

127. Corrective powers of Commission (Chapter 3)

127. (1) The Commission may, for the purposes of sections 124(3) and 125(3), do one or more than one of the following:

• (a) issue a warning to the controller or processor that intended data processing is likely to infringe a relevant provision;

• (b) issue a reprimand to the controller or processor where data processing by the controller or processor has infringed a relevant provision;

• (c) order the controller or processor to comply with a data subject’s request to exercise his or her rights under a relevant provision;

• (d) order the controller or processor to bring processing into compliance with a relevant provision, in a specified manner and within a specified period;

• (e) order the controller to communicate a personal data breach to data subjects;

• (f) impose a temporary or definitive limitation, including a ban on processing;

• (g) impose a restriction on processing by the controller or processor;

• (h) order the suspension of data transfers to a recipient in a third country or to an international organisation.

• (2) Without prejudice to the generality of sections 124(2)(b) and 125(2)(b), the Commission may, for the purposes of exercising a power specified in subsection (1), serve on the controller or processor concerned an enforcement notice requiring it to take such steps as the Commission considers necessary for those purposes.

128. Judicial remedy for infringement of relevant provision

128. (1) Subject to subsection (8), and without prejudice to any other remedy available to him or her, including his or her right under section 119 to lodge a complaint, a data subject may, where he or she considers that his or her rights under a relevant provision have been infringed as a result of the processing of his or her personal data in a manner that fails to comply with a relevant provision, bring an action (in this section referred to as a “data protection action”) against the controller or processor concerned.

• (2) A data protection action shall be deemed, for the purposes of every enactment and rule of law, to be an action founded on tort.

• (3) The Circuit Court shall, subject to subsections (5) and (6), concurrently with the High Court, have jurisdiction to hear and determine data protection actions.

• (4) The court hearing a data protection action shall have the power to grant to the plaintiff one or more than one of the following reliefs:

• (a) relief by way of injunction or declaration; or

• (b) compensation for damage suffered by the plaintiff as a result of the infringement of a relevant provision.

• (5) The compensation recoverable in a data protection action in the Circuit Court shall not exceed the amount standing prescribed, for the time being by law, as the limit of that court’s jurisdiction in tort.

• (6) The jurisdiction conferred on the Circuit Court by this section may be exercised by the judge of any circuit in which—

• (a) the controller or processor against whom the data protection action is taken has an establishment, or

• (b) the data subject has his or her habitual residence.

• (7) The court hearing a data protection action that has been brought, in accordance with section 120(1)(b), on behalf of a data subject by a body, organisation or association to which subsection (2) of that section applies shall have the power to grant to the data subject on whose behalf the action is being brought one or more of the following reliefs:

• (a) relief by way of injunction or declaration; or

• (b) compensation for damage suffered by the plaintiff as a result of the infringement of the relevant enactment.

• (8) A data subject may not bring a data protection action against a controller or processor that is a public authority of another Member State acting in the exercise of its public powers.

• (9) In this section—

“damage” includes material and non-material damage;

“injunction” means—

• (a) an interim injunction,

• (b) an interlocutory injunction, or

• (c) an injunction of indefinite duration.

Chapter 4 Inspection, Audit and Enforcement

129. Authorised officers

129. (1) The Commission may appoint such and so many members of its staff, and such and so many other suitably qualified persons, as it considers appropriate to be authorised officers for the purposes of this Act.

• (2) A person appointed under subsection (1) shall, on his or her appointment, be furnished by the Commission with a certificate of his or her appointment and, when exercising a power conferred by this Act shall, on request by any person thereby affected, produce such certificate together with a form of personal identification to that person for inspection.

• (3) A person who, immediately before the commencement of this section, was an authorised officer under section 24 of the Act of 1988 shall—

• (a) for the unexpired period of his or her term of appointment under that section, and

• (b) subject to the same terms and conditions as applied to that appointment,

be deemed to be an authorised officer appointed under subsection (1), and accordingly paragraph (a) of subsection (4) shall apply in respect of that authorised officer.

• (4) An appointment shall cease—

• (a) if the Commission revokes, in writing, the appointment,

• (b) in the case of a person who at the time of his or her appointment was a member of staff of the Commission, upon the person ceasing to be such a member of staff, or

• (c) in the case of an appointment for a fixed period, upon the expiry of that period.

• (5) In this section, “suitably qualified person” means a person other than a member of staff of the Commission who, in the opinion of the Commission, has the expertise and exper-ience necessary to perform the functions conferred on an authorised officer by this Act.

130. Powers of authorised officers

130. (1) For the purposes of this Act, a relevant enactment or a relevant provision, an authorised officer may—

• (a) subject to subsection (6), enter, at any reasonable time, any place—

• (i) where any activity connected with the processing of personal data takes place,

• (ii) where the authorised officer has reasonable grounds for believing any activity connected with the processing of personal data takes place, or

• (iii) at which the authorised officer has reasonable grounds for believing documents, records, statements or other information relating to the processing of personal data is being kept,

• (b) search and inspect the place and any documents, records, statements or other information found there,

• (c) require any person at the place, being a controller or processor, or an employee or agent of either of them, to produce to him or her any documents or records relating to the processing of personal data which are in that person’s power or control and, in the case of information in a non-legible form, to reproduce it in a legible form, and to give to the authorised officer such information as he or she may reasonably require in relation to any entries in such documents or records,

• (d) secure for later inspection—

• (i) any documents or records so provided or found and any data equipment, including any computer, in which those records may be held, or

• (ii) any such place, or part thereof, in which—

• (I) documents, records, statements or data equipment are kept, or

• (II) there are reasonable grounds for believing that such documents, records, statements or data equipment are kept,

for such period as the authorised officer may reasonably consider necessary for the purposes of the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision,

• (e) inspect and take extracts from or make copies of any such documents or records (including, in the case of information in a non-legible form, a copy of or extract from such information in a permanent legible form),

• (f) remove and retain such documents or records for such period as the authorised officer reasonably considers necessary for the purposes of the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision, or require any person referred to in paragraph (c) to retain and maintain such documents or records for such period of time, as the authorised officer reasonably considers necessary for those purposes,

• (g) if a person who is required under paragraph (c) to provide a particular record is unable to provide it, require the person to state, to the best of that person’s knowledge and belief, where the record is located or from whom it may be obtained, and

• (h) require any person referred to in paragraph (c) to give to the authorised officer any information relating to the processing of personal data that the officer may reasonably require for the purposes of the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision and to afford the officer all reasonable assistance in relation thereto.

• (2) An authorised officer may, in the performance of his or her functions under this Act, a relevant enactment or a relevant provision—

• (a) operate any data equipment, including any computer, or cause any such data equip-ment or computer to be operated by a person accompanying the authorised officer, and

• (b) require any person who appears to the authorised officer to be in a position to facilitate access to the documents or records stored in any data equipment or computer or which can be accessed by the use of that data equipment or computer to give the authorised officer all reasonable assistance in relation to the operation of the data equipment or computer or access to the records stored in it, including by—

• (i) providing the documents or records to the authorised officer in a form in which they can be taken and in which they are, or can be made, legible and comprehens-ible,

• (ii) giving to the authorised officer any password necessary to make the documents or records concerned legible and comprehensible, or

• (iii) otherwise enabling the authorised officer to examine the documents or records in a form in which they are legible and comprehensible.

• (3) When performing a function under this Act, a relevant enactment or a relevant provision, an authorised officer may, subject to any warrant under section 131, be accompanied by such and so many other authorised officers or members of the Garda Síochána as he or she considers appropriate.

• (4) An authorised officer may require a person to provide him or her with his or her name and address where the authorised officer has reasonable grounds for requiring such information for the purpose of applying for a warrant under section 131.

• (5) Where an authorised officer in the performance of his or her functions or the functions of the Commission under this Act, a relevant enactment or a relevant provision is prevented from entering any place, he or she may make an application under section 131 for a warrant to authorise such entry.

• (6) An authorised officer shall not enter a dwelling, other than—

• (a) with the consent of the occupier, or

• (b) in accordance with a warrant under section 131.

• (7) A person shall be guilty of an offence if he or she—

• (a) obstructs, impedes or assaults an authorised officer in the performance of his or her functions under this Act, a relevant enactment or a relevant provision,

• (b) fails or refuses to comply with a requirement of an authorised officer under this section,

• (c) alters, suppresses or destroys any documents, records, statements or other information which the person concerned has been required by an authorised officer to produce, or may reasonably expect to be so required to produce,

• (d) in purported compliance with a requirement under this section, gives to an authorised officer information, documents or records which the person knows to be false or misleading in a material respect,

• (e) falsely represents himself or herself to be an authorised officer, or

• (f) procures or attempts to procure any action referred to in paragraphs (a) to (e).

• (8) A person guilty of an offence under subsection (7) shall be liable—

• (a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

• (9) A statement or admission made by a person pursuant to a requirement under subsection (1) or (2) shall not be admissible in evidence in proceedings for an offence (other than an offence under paragraph (b) of subsection (7)) brought against the person.

• (10) In this section and section 131, “place” includes—

• (a) a dwelling or a part thereof,

• (b) a building or a part thereof,

• (c) any other premises or part thereof, and

• (d) a vehicle, vessel, aircraft or any other means of transport.

131. Search warrants

131. (1) If a judge of the District Court is satisfied on the sworn information of an authorised officer that there are reasonable grounds for suspecting that information required by an authorised officer for the purpose of performing his or her functions under this Part is held at any place, the judge may issue a warrant authorising him or her, accompanied if the officer considers it necessary by such other person or a member of the Garda Síochána, at any time or times from the date of issue of the warrant, on production, if so required, of the warrant, to enter, if need be by reasonable force, the place and exercise all or any of the powers conferred on an authorised officer under section 130.

• (2) The period of validity of a warrant shall be 28 days from its date of issue, but that period of validity may be extended in accordance with subsections (3) and (4).

• (3) The authorised officer may, during the period of validity of a warrant (including such period as previously extended under subsection (4)), apply to a judge of the District Court for an order extending the period of validity of the warrant and such an application shall be grounded upon information on oath laid by the authorised officer stating, by reference to the purpose or purposes for which the warrant was issued, the reasons why the authorised officer considers the extension to be necessary.

• (4) If, on the making of an application under subsection (3), the judge of the District Court is satisfied that there are reasonable grounds for believing, having regard to that information so laid, that further time is needed so that the purpose or purposes for which the warrant was issued can be fulfilled, the judge may make an order extending the period of validity of the warrant by such period as, in the opinion of the judge, is appropriate and just; and where such an order is made, the judge shall cause the warrant to be suitably endorsed to indicate its extended period of validity.

• (5) Nothing in subsections (1) to (4) prevents a judge of the District Court from issuing, on the making of a new application under subsection (1), a further search warrant under this section in relation to the same place.

132. Information notice

132. (1) The Commission or an authorised officer may, by notice in writing (referred to in this Act as an “information notice”) served on a controller or processor, require the controller or processor to furnish, in writing, within such period as may be specified in the notice and, if applicable, in the format or manner specified in the notice, such information in relation to matters specified in the notice as is necessary or expedient for the performance by the Commission of its, or by the authorised officer of his or her, functions under this Part.

• (2) Subject to subsection (3)—

• (a) an information notice shall include a statement informing the controller or processor concerned of his entitlement under section 150(1) to appeal against the requirement specified in the notice,

• (b) the period, referred to in subsection (1), specified in an information notice shall not be less than 28 days from the date on which the notice is served, and

• (c) if an appeal is brought under section 150(1) against a requirement specified in an information notice, the requirement need not be complied with and subsection (6) shall not apply in relation to the requirement, pending the determination or withdrawal of the appeal.

• (3) Where the Commission or authorised officer—

• (a) by reason of special circumstances, is of the opinion that a requirement specified in an information notice should be complied with urgently, and

• (b) includes a statement to that effect in the information notice,

subsection (2) shall not apply in relation to the notice, but the notice—

• (i) shall include a statement of the effect of subsections (3) and (4) of section 150, and

• (ii) shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.

• (4)
• (a) Nothing in this section shall be taken to compel a controller or processor, in complying with an information notice, to furnish information that would be exempt from production in proceedings in a court on the ground of legal professional privilege.

• (b) A document furnished in compliance with an information notice shall not be admissible in evidence in proceedings for an offence (other than an offence under this section) brought against any person who furnishes or concurs in the furnishing of the document.

• (5) The controller or processor concerned shall inform the Commission of any documents, records, statements or other information withheld by it under subsection (4)(a).

• (6) A controller or processor that without reasonable excuse fails to comply with a requirement specified in an information notice or that, in purported compliance with such a requirement, gives to the Commission or an authorised officer information which the controller or processor knows to be false or misleading in a material respect, shall be guilty of an offence and shall be liable—

• (a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (b) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

• (7)
• (a) An information notice may be cancelled—

• (i) where it has been issued by the Commission, by the Commission, and

• (ii) where it has been issued by an authorised officer, by the Commission or that authorised officer.

• (b) A person who cancels an information notice under paragraph (a) shall notify in writing the controller or processor on which the notice was served.

133. Enforcement notice

133. (1) In this Part, “enforcement notice” means a notice in writing served in accordance with subsection (2), subsection (3) or section 109(5)(d), 115(2), 122(4)(d) or 127(2), on a controller or processor, requiring the controller or processor to take such steps as are specified in the notice, within such time as may be so specified.

• (2) Notwithstanding anything contained in Chapter 2, the Commission or an authorised officer, where of the opinion that a controller or processor has contravened or is contravening a relevant enactment, may serve on the controller or processor an enforcement notice requiring the controller or processor to take one or more than one of the steps specified in section 109(5)(d).

• (3) Notwithstanding anything contained in Chapter 3, the Commission or an authorised officer, where of the opinion that a controller or processor has contravened or is contravening a relevant provision, may serve on the controller or processor an enforce-ment notice requiring the controller or processor to take one or more than one of the steps specified in section 122(4)(d).

• (4) An enforcement notice shall include a statement informing the controller or processor concerned of its entitlement under section 150(1) to appeal against a requirement specified in the notice.

• (5) Where an enforcement notice is served under section 109(5)(d), 122(4)(d), subsection (2) or subsection (3)—

• (a) the notice shall specify the relevant enactment or relevant provision, as applicable, that in the opinion of the Commission or, where applicable, authorised officer, has been or is being contravened and the reasons for having formed that opinion, and

• (b) subject to subsection (6)—

• (i) the period, referred to in subsection (1), specified in an enforcement notice shall be not less than 28 days from the date on which the notice is served, and

• (ii) if an appeal is brought under section 150(1) against a requirement specified in the notice, the requirement need not be complied with and, pending the determination or withdrawal of the appeal, subsections (9) and (10) shall not apply in relation to the requirement.

• (6) Where the Commission or authorised officer—

• (a) by reason of special circumstances, is of the opinion that a requirement specified in an enforcement notice referred to in subsection (5) should be complied with urgently, and

• (b) includes a statement to that effect in the enforcement notice,

subsection (5)(b) shall not apply in relation to the notice, but the notice—

• (i) shall include a statement of the effect of subsections (3) and (4) of section 150, and

• (ii) shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.

• (7)
• (a) Subject to paragraph (b), a controller or processor, having complied with an enforcement notice, shall, as soon as may be and in any event not more than 28 days after such compliance, notify the following of the steps taken to comply with the enforcement notice:

• (i) the Commission or the authorised officer concerned;

• (ii) any data subject concerned.

• (b) Where the compliance with an enforcement notice has involved the rectification or erasure of personal data or the restriction of processing, the controller and processor shall, in complying with paragraph (a), in addition—

• (i) notify any recipient to whom the data have been disclosed, or

• (ii) where compliance with subparagraph (i) proves impossible or involves a dispropor-tionate effort, and where the data subject so requests, notify the data subject of the recipients or the categories of recipients.

• (8)
• (a) An enforcement notice may be cancelled—

• (i) where it has been issued by the Commission, by the Commission, and

• (ii) where it has been issued by an authorised officer, by the Commission or that authorised officer.

• (b) A person who cancels an enforcement notice under paragraph (a) shall notify in writing the controller or processor on which the notice was served.

• (9)
• (a) The Commission may, subject to Chapter 6, decide to impose an administrative fine on a controller or processor that, without reasonable excuse, fails to comply with a requirement specified in an enforcement notice served on the controller or processor under section 109(5)(d), 115(2) or subsection (2).

• (b) The Commission, as soon as practicable after making its decision under paragraph (a), shall give the controller or processor concerned a notice in writing informing it of the decision.

• (10) A controller or processor that, without reasonable excuse, fails to comply with—

• (a) a requirement specified in an enforcement notice, or

• (b) subsection (7),

shall be guilty of an offence and shall be liable—

• (i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or

• (ii) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years or both.

134. Circumstances in which application may be made to the High Court for suspension or restriction of processing of data

134. (1) Without prejudice to Articles 58(2) and 66 of the Data Protection Regulation and subsection (4), the Commission, where it considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects under a relevant enactment, until steps or further steps are taken under the relevant enactment, may, on notice to the controller or processor concerned, make an application in a summary manner to the High Court for an order under subsection (2).

• (2) The High Court may determine an application under subsection (1) by—

• (a) making any order that it considers appropriate, including an order suspending, restricting or prohibiting—

• (i) the processing by the controller or processor of the personal data concerned, or

• (ii) the transfer by the controller or processor of such data to a recipient in a third country or to an international organisation,

for such period, or until the occurrence of such event, as is specified in the order, and

• (b) giving to the Commission any other direction that the High Court considers appropriate.

• (3) The Commission shall, on complying with a direction of the High Court under subsection (2)(b), give notice in writing to the controller or processor concerned of the Commission’s compliance with the direction.

• (4) Where the Commission considers that the immediate suspension, restriction or prohibition of the processing of personal data or the transfer of such data to a recipient in a third country or to an international organisation is necessary in order to protect the rights and freedoms of data subjects under a relevant enactment, it may apply in a summary manner exparte to the High Court for an interim order under subsection (6).

• (5) An application under subsection (4) shall be grounded on an affidavit sworn by or on behalf of the Commission.

• (6)
• (a) The High Court may, on an application under subsection (4), where, having regard to the circumstances of the case, the Court considers it necessary to do so for the protection of the rights and freedoms of data subjects, make an interim order suspending, restricting or prohibiting—

• (i) the processing by the controller or processor of the personal data concerned, or

• (ii) the transfer by the controller or processor of such data to a recipient in a third country or to an international organisation.

• (b) Without prejudice to subsection (7), where an interim order is made under this subsection, the Commission shall, as soon as is practicable, serve a copy of the order and of the affidavit referred to in subsection (5) on the controller or processor concerned.

• (c) An interim order under this subsection shall have effect for such period, not exceeding 7 working days, as is specified in the order, and shall cease to have effect on the determination by the High Court of an application under subsection (1).

• (7)
• (a) An interim order under subsection (6) shall take effect on notification of its making being given to the controller or processor.

• (b) Oral communication to the controller or processor by or on behalf of the Commission of the fact that an interim order has been made, together with production of a copy of such order, shall, without prejudice to any other form of notification, be taken to be sufficient notification to the controller or processor concerned of the making of the order.

• (8) The Commission shall communicate the details of an order made by the High Court under this section to the—

• (a) European Commission,

• (b) European Data Protection Board, and

• (c) other supervisory authorities concerned.

135. Power to require report

135. (1) The Commission may, for the purposes of proper and effective monitoring of the application of a relevant enactment, and having regard to the matters set out in subsection (3), by notice in writing given to a controller or processor, require the controller or processor to provide to the Commission, in accordance with such notice, a report on any matter specified in the notice about which the Commission has required or could require the provision of information, or the production of any statement, record or document under any provision of a relevant enactment.

• (2) A notice under subsection (1) shall be in writing and shall state—

• (a) the date on which the notice is given,

• (b) the period within which the controller or processor shall nominate a person to the Commission for approval under subsection (4),

• (c) the purpose, scope and form of the report,

• (d) the matters required to be reported on,

• (e) the timetable for completion of the report,

• (f) whether the report is to include recommendations in relation to the improved compliance by the controller or processor with a relevant enactment,

• (g) where appropriate, the methodology to be used in preparation of the report, and

• (h) such other matters relating to the report as the Commission considers appropriate.

• (3) Before giving a notice under this section, the Commission, taking account of the purpose for which the report is required, shall have regard to at least the following matters—

• (a) whether any other powers that may be exercised by the Commission may be more appropriate in the circumstances concerned,

• (b) the relevant knowledge and expertise available to the controller or processor, and

• (c) the level of resources available to the controller or processor and the likely benefit to the controller or processor of providing the report.

• (4) A report required to be provided to the Commission under this section shall be prepared by a person (referred to as the “reviewer”)—