Data Protection Act 2018

the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.

• (5) A court may make an order under this section in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for carrying out the rectification, erasure or restriction of processing that the court proposes to order.

• (6) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

CHAPTER 4 — Controller and processor

Overview

Overview

101

This Chapter sets out—

• (a) the general obligations of controllers and processors (see sections 102 to 106);

• (b) specific obligations of controllers and processors with respect to security (see section 107);

• (c) specific obligations of controllers and processors with respect to personal data breaches (see section 108).

General obligations

General obligations of the controller

102

Each controller must implement appropriate measures—

• (a) to ensure, and

• (b) to be able to demonstrate, in particular to the Commissioner,

that the processing of personal data complies with the requirements of this Part.

Data protection by design

103

• (1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.

• (2) A controller must implement appropriate technical and organisational measures which are designed to ensure that—

• (a) the data protection principles are implemented, and

• (b) risks to the rights and freedoms of data subjects are minimised.

Joint controllers

104

• (1) Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.

• (2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.

• (3) The arrangement must designate the controller which is to be the contact point for data subjects.

Processors

105

• (1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.

• (2) The controller may use only a processor who undertakes—

• (a) to implement appropriate measures that are sufficient to secure that the processing complies with this Part;

• (b) to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part.

• (3) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.

Processing under the authority of the controller or processor

106

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—

• (a) on instructions from the controller, or

• (b) to comply with a legal obligation.

Obligations relating to security

Security of processing

107

• (1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data.

• (2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—

• (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,

• (b) ensure that it is possible to establish the precise details of any processing that takes place,

• (c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

• (d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

Obligations relating to personal data breaches

Communication of a personal data breach

108

• (1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must notify the Commissioner of the breach without undue delay.

• (2) Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.

• (3) Subject to subsection (4), the notification must include—

• (a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

• (b) the name and contact details of the contact point from whom more information can be obtained;

• (c) a description of the likely consequences of the personal data breach;

• (d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

• (4) Where and to the extent that it is not possible to provide all the information mentioned in subsection (3) at the same time, the information may be provided in phases without undue further delay.

• (5) If a processor becomes aware of a personal data breach (in relation to data processed by the processor), the processor must notify the controller without undue delay.

• (6) Subsection (1) does not apply in relation to a personal data breach if the breach also constitutes a relevant error within the meaning given by section 231(9) of the Investigatory Powers Act 2016.

• (7) For the purposes of this section, a personal data breach is serious if the breach seriously interferes with the rights and freedoms of a data subject.

CHAPTER 5 — Transfers of personal data outside the United Kingdom

Transfers of personal data outside the United Kingdom

109

• (1) A controller may not transfer personal data to—

• (a) a country or territory outside the United Kingdom, or

• (b) an international organisation,

unless the transfer falls within subsection (2).

• (2) A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—

• (a) for the purposes of the controller's statutory functions, or

• (b) for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.

CHAPTER 6 — Exemptions

National security

110

• (1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the purpose of safeguarding national security.

• (2) The provisions are—

• (a) Chapter 2 of this Part (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;

• (b) Chapter 3 of this Part (rights of data subjects);

• (c) in Chapter 4 of this Part, section 108 (communication of a personal data breach to the Commissioner);

• (d) in Part 5—

• (i) section 119 (inspection in accordance with international obligations);

• (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(a) and (g) and 2;

• (e) in Part 6—

• (i) sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);

• (ii) sections 170 to 173 (offences relating to personal data);

• (iii) sections 174 to 176 (provision relating to the special purposes).

National security: certificate

111

• (1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section 110(2) is, or at any time was, required for the purpose of safeguarding national security in respect of any personal data is conclusive evidence of that fact.

• (2) A certificate under subsection (1)—

• (a) may identify the personal data to which it applies by means of a general description, and

• (b) may be expressed to have prospective effect.

• (3) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.

• (4) If on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may—

• (a) allow the appeal, and

• (b) quash the certificate.

• (5) Where, in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

• (6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.

• (7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.

• (8) A document purporting to be a certificate under subsection (1) is to be—

• (a) received in evidence, and

• (b) deemed to be such a certificate unless the contrary is proved.

• (9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—

• (a) in any legal proceedings, evidence of that certificate, and

• (b) in any legal proceedings in Scotland, sufficient evidence of that certificate.

• (10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—

• (a) a Minister who is a member of the Cabinet, or

• (b) the Attorney General or the Advocate General for Scotland.

Other exemptions

112

Schedule 11 provides for further exemptions.

Power to make further exemptions

113

• (1) The Secretary of State may by regulations amend Schedule 11—

• (a) by adding exemptions from any provision of this Part;

• (b) by omitting exemptions added by regulations under paragraph (a).

• (2) Regulations under this section are subject to the affirmative resolution procedure.

PART 5 — The Information Commissioner

The Commissioner

The Information Commissioner

114

• (1) There is to continue to be an Information Commissioner.

• (2) Schedule 12 makes provision about the Commissioner.

General functions

General functions under the GDPR and safeguards

115

• (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (2) General functions are conferred on the Commissioner by—

• (a) Article 57 of the UK GDPR (tasks), and

• (b) Article 58 of the UK GDPR (powers),

(and see also the Commissioner's duty under section 2 and section 28(5)).

• (3) The Commissioner's functions in relation to the processing of personal data to which the UK GDPR applies include—

• (a) a duty to advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, and

• (b) a power to issue, on the Commissioner's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.

• (4) The Commissioner's functions under Article 58 of the UK GDPR are subject to the safeguards in subsections (5) to (9).

• (5) The Commissioner's power under Article 58(1)(a) of the UK GDPR (power to require a controller or processor to provide information that the Commissioner requires for the performance of the Commissioner's tasks under the UK GDPR) is exercisable only by giving an information notice under section 142.

• (6) The Commissioner's power under Article 58(1)(b) of the UK GDPR (power to carry out data protection audits) is exercisable only in accordance with section 146.

• (7) The Commissioner's powers under Article 58(1)(e) and (f) of the UK GDPR (power to obtain information from controllers and processors and access to their premises) are exercisable only—

• (a) in accordance with Schedule 15 (see section 154), or

• (b) to the extent that they are exercised in conjunction with the power under Article 58(1)(b) of the UK GDPR, in accordance with section 146.

• (8) The following powers are exercisable only by giving an enforcement notice under section 149—

• (a) the Commissioner's powers under Article 58(2)(c) to (g) and (j) of the UK GDPR (certain corrective powers);

• (b) the Commissioner's powers under Article 58(2)(h) to order a certification body to withdraw, or not to issue, a certification under Articles 42 and 43 of the UK GDPR.

• (9) The Commissioner's powers under Articles 58(2)(i) and 83 of the UK GDPR (administrative fines) are exercisable only by giving a penalty notice under section 155.

• (10) This section is without prejudice to other functions conferred on the Commissioner, whether by the UK GDPR, this Act or otherwise.

Other general functions

116

• (A1) The Commissioner is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation to processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) and to facilitate the free flow of personal data.

• (1) The Commissioner—

• (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (b) is to continue to be the designated authority in the United Kingdom for the purposes of Article 13 of the Data Protection Convention.

• (2) Schedule 13 confers general functions on the Commissioner in connection with processing to which the UK GDPR does not apply (and see also the Commissioner's duty under section 2).

• (3) This section and Schedule 13 are without prejudice to other functions conferred on the Commissioner, whether by this Act or otherwise.

Competence in relation to courts etc

117

Nothing in this Act or the UK GDPR permits or requires the Commissioner to exercise functions in relation to the processing of personal data by—

• (a) an individual acting in a judicial capacity, or

• (b) a court or tribunal acting in its judicial capacity ...

....

International role

Co-operation and mutual assistance

118

• (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (5) Part 2 of Schedule 14 makes provision as to the functions to be carried out by the Commissioner for the purposes of Article 13 of the Data Protection Convention (co-operation between parties).

Inspection of personal data in accordance with international obligations

119

• (1) The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2).

• (2) The power under subsection (1) is exercisable only if the personal data—

• (a) is processed wholly or partly by automated means, or

• (b) is processed otherwise than by automated means and forms part of a filing system or is intended to form part of a filing system.

• (3) The power under subsection (1) includes power to inspect, operate and test equipment which is used for the processing of personal data.

• (4) Before exercising the power under subsection (1), the Commissioner must by written notice inform the controller and any processor that the Commissioner intends to do so.

• (5) Subsection (4) does not apply if the Commissioner considers that the case is urgent.

• (6) It is an offence—

• (a) intentionally to obstruct a person exercising the power under subsection (1), or

• (b) to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.

• (7) Paragraphs (c) and (d) of section 3(14) do not apply to references in this section to personal data, the processing of personal data, a controller or a processor.

Further international role

120

• (1) The Commissioner must, in relation to third countries and international organisations, take appropriate steps to—

• (a) develop international co-operation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;

• (b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data and ... fundamental rights and freedoms;

• (c) engage relevant stakeholders in discussion and activities aimed at furthering international co-operation in the enforcement of legislation for the protection of personal data;

• (d) promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.

• (2) Subsection (1) applies only in connection with the processing of personal data to which the UK GDPR does not apply; for the equivalent duty in connection with the processing of personal data to which the UK GDPR applies, see Article 50 of the UK GDPR (international co-operation for the protection of personal data).

• (2A) The Commissioner may contribute to the activities of international organisations with data protection functions.

• (3) The Commissioner must carry out data protection functions which the Secretary of State directs the Commissioner to carry out for the purpose of enabling Her Majesty's Government in the United Kingdom to give effect to an international obligation of the United Kingdom.

• (4) The Commissioner may provide an authority carrying out data protection functions under the law of a British overseas territory with assistance in carrying out those functions.

• (5) The Secretary of State may direct that assistance under subsection (4) is to be provided on terms, including terms as to payment, specified or approved by the Secretary of State.

• (6) In this section—

• “data protection functions” means functions relating to the protection of individuals with respect to the processing of personal data;

• “mutual assistance in the enforcement of legislation for the protection of personal data” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange;

• “third country” means a country or territory outside the United Kingdom.

• (7) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.

Codes of practice

Data-sharing code

121

• (1) The Commissioner must prepare a code of practice which contains—

• (a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation, and

• (b) such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data.

• (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

• (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

• (a) trade associations;

• (b) data subjects;

• (c) persons who appear to the Commissioner to represent the interests of data subjects.

• (4) A code under this section may include transitional provision or savings.

• (5) In this section—

• “good practice in the sharing of personal data” means such practice in the sharing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;

• “the sharing of personal data” means the disclosure of personal data by transmission, dissemination or otherwise making it available;

• “trade association” includes a body representing controllers or processors.

Direct marketing code

122

• (1) The Commissioner must prepare a code of practice which contains—

• (a) practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426), and

• (b) such other guidance as the Commissioner considers appropriate to promote good practice in direct marketing.

• (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

• (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

• (a) trade associations;

• (b) data subjects;

• (c) persons who appear to the Commissioner to represent the interests of data subjects.

• (4) A code under this section may include transitional provision or savings.

• (5) In this section—

• “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;

• “good practice in direct marketing” means such practice in direct marketing as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a);

• “trade association” includes a body representing controllers or processors.

Age-appropriate design code

123

• (1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children.

• (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

• (3) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such other persons as the Commissioner considers appropriate, including—

• (a) children,

• (b) parents,

• (c) persons who appear to the Commissioner to represent the interests of children,

• (d) child development experts, and

• (e) trade associations.

• (4) In preparing a code or amendments under this section, the Commissioner must have regard—

• (a) to the fact that children have different needs at different ages, and

• (b) to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.

• (5) A code under this section may include transitional provision or savings.

• (6) Any transitional provision included in the first code under this section must cease to have effect before the end of the period of 12 months beginning when the code comes into force.

• (7) In this section—

• “age-appropriate design” means the design of services so that they are appropriate for use by, and meet the development needs of, children;

• “information society services” has the same meaning as in the UK GDPR, but does not include preventive or counselling services;

• “relevant information society services” means information society services which involve the processing of personal data to which the UK GDPR applies;

• “standards of age-appropriate design of relevant information society services” means such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children;

• “trade association” includes a body representing controllers or processors;

• “the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.

Data protection and journalism code

124

• (1) The Commissioner must prepare a code of practice which contains—

• (a) practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation, and

• (b) such other guidance as the Commissioner considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.

• (2) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

• (3) Before preparing a code or amendments under this section, the Commissioner must consult such of the following as the Commissioner considers appropriate—

• (a) trade associations;

• (b) data subjects;

• (c) persons who appear to the Commissioner to represent the interests of data subjects.

• (4) A code under this section may include transitional provision or savings.

• (5) In this section—

• “good practice in the processing of personal data for the purposes of journalism” means such practice in the processing of personal data for those purposes as appears to the Commissioner to be desirable having regard to—the interests of data subjects and others ..., andthe special importance of the public interest in the freedom of expression and information; and includes compliance with the requirements of the data protection legislation;

• “trade association” includes a body representing controllers or processors.

Approval of codes prepared under sections 121 to 124

125

• (1) When a code is prepared under section 121, 122, 123 , 124 or 124A—

• (a) the Commissioner must submit the final version to the Secretary of State, and

• (b) the Secretary of State must lay the code before Parliament.

• (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 , 124 or 124A, the Commissioner must not issue the code.

• (4) If no such resolution is made within that period—

• (a) the Commissioner must issue the code, and

• (b) the code comes into force at the end of the period of 21 days beginning with the day on which it is issued.

• (5) If the Commissioner is prevented by subsection (3) from issuing a code that is not a replacement code, the Commissioner must prepare another version of the code.

• (6) Nothing in subsection (3) prevents another version of the code being laid before Parliament.

• (7) In this section, “the 40-day period” means—

• (a) if the code is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

• (b) if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

• (8) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.

• (9) This section, other than subsection (5), applies in relation to amendments prepared under section 121, 122, 123 , 124 or 124A as it applies in relation to codes prepared under those sections.

Publication and review of codes issued under section 125(4)

126

• (1) The Commissioner must publish a code issued under section 125(4).

• (2) Where an amendment of a code is issued under section 125(4), the Commissioner must publish—

• (a) the amendment, or

• (b) the code as amended by it.

• (3) The Commissioner must keep under review each code issued under section 125(4) for the time being in force.

• (4) Where the Commissioner becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commissioner must exercise the power under section 121(2), 122(2), 123(2) , 124(2) or 124A(3) with a view to remedying the situation.

Effect of codes issued under section 125(4)

127

• (1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal proceedings in a court or tribunal.

• (2) A code issued under section 125(4), including an amendment or replacement code, is admissible in evidence in legal proceedings.

• (3) In any proceedings before a court or tribunal, the court or tribunal must take into account a provision of a code issued under section 125(4) in determining a question arising in the proceedings if—

• (a) the question relates to a time when the provision was in force, and

• (b) the provision appears to the court or tribunal to be relevant to the question.

• (4) Where the Commissioner is carrying out a function described in subsection (5), the Commissioner must take into account a provision of a code issued under section 125(4) in determining a question arising in connection with the carrying out of the function if—

• (a) the question relates to a time when the provision was in force, and

• (b) the provision appears to the Commissioner to be relevant to the question.

• (5) Those functions are functions under—

• (a) the data protection legislation, or

• (b) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).

Other codes of practice

128

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Consensual audits

Consensual audits

129

• (1) The Commissioner's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to carry out an assessment of whether the controller or processor is complying with good practice in the processing of personal data.

• (2) The Commissioner must inform the controller or processor of the results of such an assessment.

• (3) In this section, “good practice in the processing of personal data” has the same meaning as in section 124A.

Records of national security certificates

Records of national security certificates

130

• (1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the certificate to the Commissioner.

• (2) If the Commissioner receives a copy of a certificate under subsection (1), the Commissioner must publish a record of the certificate.

• (3) The record must contain—

• (a) the name of the Minister who issued the certificate,

• (b) the date on which the certificate was issued, and

• (c) subject to subsection (4), the text of the certificate.

• (4) The Commissioner must not publish the text, or a part of the text, of the certificate if—

• (a) the Minister determines that publishing the text or that part of the text—

• (i) would be against the interests of national security,

• (ii) would be contrary to the public interest, or

• (iii) might jeopardise the safety of any person, and

• (b) the Minister has notified the Commissioner of that determination.

• (5) The Commissioner must keep the record of the certificate available to the public while the certificate is in force.

• (6) If a Minister of the Crown revokes a certificate issued under section 27, 79 or 111, the Minister must notify the Commissioner.

Information provided to the Commissioner

Disclosure of information to the Commissioner

131

• (1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commissioner with information necessary for the discharge of the Commissioner's functions.

• (2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

• (3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.

Confidentiality of information

132

• (1) A person who is or has been the Commissioner, or a member of the Commissioner's staff or an agent of the Commissioner, must not disclose information which—

• (a) has been obtained by, or provided to, the Commissioner in the course of, or for the purposes of, the discharging of the Commissioner's functions,

• (b) relates to an identified or identifiable individual or business, and

• (c) is not available to the public from other sources at the time of the disclosure and has not previously been available to the public from other sources,

unless the disclosure is made with lawful authority.

• (2) For the purposes of subsection (1), a disclosure is made with lawful authority only if and to the extent that—

• (a) the disclosure was made with the consent of the individual or of the person for the time being carrying on the business,

• (b) the information was obtained or provided as described in subsection (1)(a) for the purpose of its being made available to the public (in whatever manner),

• (c) the disclosure was made for the purposes of, and is necessary for, the discharge of one or more of the Commissioner's functions,

• (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (e) the disclosure was made for the purposes of criminal or civil proceedings, however arising, or

• (f) having regard to the rights, freedoms and legitimate interests of any person, the disclosure was necessary in the public interest.

• (3) It is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).

Guidance about privileged communications

133

• (1) The Commissioner must produce and publish guidance about—

• (a) how the Commissioner proposes to secure that privileged communications which the Commissioner obtains or has access to in the course of carrying out the Commissioner's functions are used or disclosed only so far as necessary for carrying out those functions, and

• (b) how the Commissioner proposes to comply with restrictions and prohibitions on obtaining or having access to privileged communications which are imposed by an enactment.

• (2) The Commissioner—

• (a) may alter or replace the guidance, and

• (b) must publish any altered or replacement guidance.

• (3) The Commissioner must consult the Secretary of State before publishing guidance under this section (including altered or replacement guidance).

• (4) The Commissioner must arrange for guidance under this section (including altered or replacement guidance) to be laid before Parliament.

• (5) In this section, “privileged communications” means—

• (a) communications made—

• (i) between a professional legal adviser and the adviser's client, and

• (ii) in connection with the giving of legal advice to the client with respect to legal obligations, liabilities or rights, and

• (b) communications made—

• (i) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

• (ii) in connection with or in contemplation of legal proceedings, and

• (iii) for the purposes of such proceedings.

• (6) In subsection (5)—

• (a) references to the client of a professional legal adviser include references to a person acting on behalf of the client, and

• (b) references to a communication include—

• (i) a copy or other record of the communication, and

• (ii) anything enclosed with or referred to in the communication if made as described in subsection (5)(a)(ii) or in subsection (5)(b)(ii) and (iii).

Fees

Fees for services

134

The Commissioner may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at the person's request, which the Commissioner is required or authorised to provide under the data protection legislation.

Manifestly unfounded or excessive requests by data subjects etc

135

• (A1) This section makes provision about cases in which a request made to the Commissioner, to which the Commissioner is required or authorised to respond under the data protection legislation, is manifestly unfounded or excessive.

• (1) ... The Commissioner may—

• (a) charge a reasonable fee for dealing with the request, or

• (b) refuse to act on the request.

• (1A) In subsection (1)—

• (a) the reference in paragraph (a) to charging a reasonable fee is, in a case in which section 134 is relevant, a reference to doing so under that section, and

• (b) paragraph (b) is not to be read as implying anything about whether the Commissioner may refuse to act on requests that are neither manifestly unfounded nor excessive.

• (2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.

• (3) In any proceedings where there is an issue as to whether a request described in subsection (A1) is manifestly unfounded or excessive, it is for the Commissioner to show that it is.

• (4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (5) Article 57(3) of the UK GDPR (performance of Commissioner’s tasks generally to be free of charge for data subject) has effect subject to this section.

Guidance about fees

136

• (1) The Commissioner must produce and publish guidance about the fees the Commissioner proposes to charge in accordance with—

• (a) section 134 or 135, ...

• (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (2) Before publishing the guidance, the Commissioner must consult the Secretary of State.

Charges

Charges payable to the Commissioner by controllers

137

• (1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commissioner.

• (2) Regulations under subsection (1) may require a controller to pay a charge regardless of whether the Commissioner has provided, or proposes to provide, a service to the controller.

• (3) Regulations under subsection (1) may—

• (a) make provision about the time or times at which, or period or periods within which, a charge must be paid;

• (b) make provision for cases in which a discounted charge is payable;

• (c) make provision for cases in which no charge is payable;

• (d) make provision for cases in which a charge which has been paid is to be refunded.

• (4) In making regulations under subsection (1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Commissioner under such regulations are sufficient to offset—

• (a) expenses incurred by the Commissioner in discharging the Commissioner's functions—

• (i) under the data protection legislation,

• (ii) under the Data Protection Act 1998,

• (iii) under or by virtue of sections 108 and 109 of the Digital Economy Act 2017, and

• (iv) under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426),

• (b) any expenses of the Secretary of State in respect of the Commissioner so far as attributable to those functions,

• (c) to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and

• (d) to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the Superannuation Act 1972 or section 1 of the Public Service Pensions Act 2013.

• (5) The Secretary of State may from time to time require the Commissioner to provide information about the expenses referred to in subsection (4)(a).

• (6) The Secretary of State may by regulations make provision—

• (a) requiring a controller to provide information to the Commissioner, or

• (b) enabling the Commissioner to require a controller to provide information to the Commissioner,

for either or both of the purposes mentioned in subsection (7).

• (7) Those purposes are—

• (a) determining whether a charge is payable by the controller under regulations under subsection (1);

• (b) determining the amount of a charge payable by the controller.

• (8) The provision that may be made under subsection (6)(a) includes provision requiring a controller to notify the Commissioner of a change in the controller's circumstances of a kind specified in the regulations.

Regulations under section 137: supplementary

138

• (1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate (and see also section 182).

• (2) The Commissioner—

• (a) must keep under review the working of regulations under section 137(1) or (6), and

• (b) may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.

• (3) The Secretary of State must review the working of regulations under section 137(1) or (6)—

• (a) at the end of the period of 5 years beginning with the making of the first set of regulations under section 108 of the Digital Economy Act 2017, and

• (b) at the end of each subsequent 5 year period.

• (4) Regulations under section 137(1) are subject to the negative resolution procedure if—

• (a) they only make provision increasing a charge for which provision is made by previous regulations under section 137(1) or section 108(1) of the Digital Economy Act 2017, and

• (b) they do so to take account of an increase in the retail prices index since the previous regulations were made.

• (5) Subject to subsection (4), regulations under section 137(1) or (6) are subject to the affirmative resolution procedure.

• (6) In subsection (4), “the retail prices index” means—

• (a) the general index of retail prices (for all items) published by the Statistics Board, or

• (b) where that index is not published for a month, any substitute index or figures published by the Board.

• (7) Regulations under section 137(1) or (6) may not apply to—

• (a) Her Majesty in her private capacity,

• (b) Her Majesty in right of the Duchy of Lancaster, or

• (c) the Duke of Cornwall.

Reports etc

Reporting to Parliament

139

• (1) The Commissioner must—

• (a) produce a general report on the carrying out of the Commissioner's functions annually,

• (b) arrange for it to be laid before Parliament, and

• (c) publish it.

• (1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)—

• (a) a review of what the Commissioner has done during the reporting period to comply with the duties under—

• (i) sections 120A and 120B,

• (ii) section 108 of the Deregulation Act 2015, and

• (iii) section 21 of the Legislative and Regulatory Reform Act 2006,

including a review of the operation of the strategy prepared and published under section 120C;

• (b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D.

• (1B) In subsection (1A), “the reporting period” means the period to which the report relates.

• (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

• (2A) The report under this section may include the annual report under section 161A.

• (3) The Commissioner may produce other reports relating to the carrying out of the Commissioner's functions and arrange for them to be laid before Parliament.

Publication by the Commissioner

140

A duty under this Act for the Commissioner to publish a document is a duty for the Commissioner to publish it, or to arrange for it to be published, in such form and manner as the Commissioner considers appropriate.

Notices from the Commissioner

141

• (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.

• (2) The notice may be given to an individual—

• (a) by delivering it to the individual,

• (b) by sending it to the individual by post addressed to the individual at his or her usual or last-known place of residence or business, or

• (c) by leaving it for the individual at that place.

• (3) The notice may be given to a body corporate or unincorporate—

• (a) by sending it by post to the proper officer of the body at its principal office, or

• (b) by addressing it to the proper officer of the body and leaving it at that office.

• (4) The notice may be given to a partnership in Scotland—

• (a) by sending it by post to the principal office of the partnership, or

• (b) by addressing it to that partnership and leaving it at that office.

• (5) The notice may be given to the person by other means, including by electronic means, with the person's consent.

• (6) In this section—

• “principal office”, in relation to a registered company, means its registered office;

• “proper officer”, in relation to any body, means the secretary or other executive officer charged with the conduct of its general affairs;

• “registered company” means a company registered under the enactments relating to companies for the time being in force in the United Kingdom.

• (7) This section is without prejudice to any other lawful method of giving a notice.

PART 6 — Enforcement

Information notices

Information notices

142

• (1) The Commissioner may, by written notice (an “information notice”)—

• (a) require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or

• (b) require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—

• (i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or

• (ii) determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

• (2) An information notice must state—

• (a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

• (b) why the Commissioner requires the information.

• (3) An information notice—

• (a) may specify or describe particular information or a category of information;

• (b) may specify the form in which the information must be provided;

• (c) may specify the time at which, or the period within which, the information must be provided;

• (d) may specify the place where the information must be provided;

(but see the restrictions in subsections (5) to (7)).

• (4) An information notice must provide information about—

• (a) the consequences of failure to comply with it, and

• (b) the rights under sections 162 and 164 (appeals etc).

• (5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.

• (6) If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.

• (7) If an information notice—

• (a) states that, in the Commissioner's opinion, the information is required urgently, and

• (b) gives the Commissioner's reasons for reaching that opinion,

subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.

• (8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.

• (9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the UK GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the UK GDPR (representatives of controllers or processors not established in the United Kingdom).

• (10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).

Information notices: restrictions

143

• (1) The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless—

• (a) a determination under section 174 with respect to the data or the processing has taken effect, or

• (b) the Commissioner—

• (i) has reasonable grounds for suspecting that such a determination could be made, and

• (ii) the information is required for the purposes of making such a determination.

• (2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

• (3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

• (a) between a professional legal adviser and the adviser's client, and

• (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

• (4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

• (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

• (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

• (c) for the purposes of such proceedings.

• (5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

• (6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.

• (7) The reference to an offence in subsection (6) does not include an offence under—

• (a) this Act;

• (b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

• (c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

• (d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

• (8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—

• (a) in giving evidence the person provides information inconsistent with the statement, and

• (b) evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.

• (9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the UK GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.

False statements made in response to information notices

144

It is an offence for a person, in response to an information notice—

• (a) to make a statement which the person knows to be false in a material respect, or

• (b) recklessly to make a statement which is false in a material respect.

Information orders

145

• (1) This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice.

• (2) The court may make an order requiring the person to provide to the Commissioner some or all of the following—

• (a) information referred to in the information notice;

• (b) other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).

• (3) The order—

• (a) may specify the form in which the information must be provided,

• (b) must specify the time at which, or the period within which, the information must be provided, and

• (c) may specify the place where the information must be provided.

Assessment notices

Assessment notices

146

• (1) The Commissioner may by written notice (an “assessment notice”) require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.

• (2) An assessment notice may require the controller or processor to do any of the following—

• (a) permit the Commissioner to enter specified premises;

• (b) direct the Commissioner to documents on the premises that are of a specified description;

• (c) assist the Commissioner to view information of a specified description that is capable of being viewed using equipment on the premises;

• (d) comply with a request from the Commissioner for a copy (in such form as may be requested) of—

• (i) the documents to which the Commissioner is directed;

• (ii) the information which the Commissioner is assisted to view;

• (e) direct the Commissioner to equipment or other material on the premises which is of a specified description;

• (f) permit the Commissioner to inspect or examine the documents, information, equipment or material to which the Commissioner is directed or which the Commissioner is assisted to view;

• (g) provide the Commissioner with an explanation of such documents, information, equipment or material;

• (h) permit the Commissioner to observe the processing of personal data that takes place on the premises;

• (i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed;

• (j) make arrangements for an approved person to prepare a report on a specified matter;

• (k) provide to the Commissioner a report prepared in pursuance of such arrangements.

• (3) In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff.

• (3A) An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—

• (a) the preparation of the report;

• (b) the contents of the report;

• (c) the form in which the report is to be provided;

• (d) the date by which the report is to be completed.

• (4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).

• (5) An assessment notice must provide information about—

• (a) the consequences of failure to comply with it, and

• (b) the rights under sections 162 and 164 (appeals etc).

• (6) An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.

• (7) If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.

• (8) If an assessment notice—

• (a) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently,

• (b) gives the Commissioner's reasons for reaching that opinion, and

• (c) does not meet the conditions in subsection (9)(a) to (d),

subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.

• (9) If an assessment notice—

• (a) states that, in the Commissioner's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed,

• (b) indicates the nature of the suspected failure or offence,

• (c) does not specify domestic premises,

• (d) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and

• (e) gives the Commissioner's reasons for reaching that opinion,

subsections (6) and (7) do not apply.

• (10) The Commissioner may cancel an assessment notice by written notice to the controller or processor to whom it was given.

• (11) Where the Commissioner gives an assessment notice to a processor, the Commissioner must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.

• (11A) Where the Commissioner gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.

• (12) In this section—

• “approved person”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;

• “domestic premises” means premises, or a part of premises, used as a dwelling;

• “specified” means specified in an assessment notice.

Assessment notices: restrictions

147

• (1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.

• (2) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—

• (a) between a professional legal adviser and the adviser's client, and

• (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

• (3) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—

• (a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

• (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

• (c) for the purposes of such proceedings.

• (4) In subsections (2) and (3)—

• (a) references to the client of a professional legal adviser include references to a person acting on behalf of such a client, and

• (b) references to a communication include—

• (i) a copy or other record of the communication, and

• (ii) anything enclosed with or referred to in the communication if made as described in subsection (2)(b) or in subsection (3)(b) and (c).

• (5) The Commissioner may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes.

• (6) The Commissioner may not give an assessment notice to—

• (a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), ...

• (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Information notices and assessment notices: destruction of documents etc

Destroying or falsifying information and documents etc

148

• (1) This section applies where a person—

• (a) has been given an information notice requiring the person to provide the Commissioner with information, or

• (b) has been given an assessment notice requiring the person to direct the Commissioner to a document, equipment or other material or to assist the Commissioner to view information.

• (2) It is an offence for the person—

• (a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or

• (b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,

with the intention of preventing the Commissioner from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.

• (3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.

Enforcement notices

Enforcement notices

149

• (1) Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) or (5), the Commissioner may give the person a written notice (an “enforcement notice”) which requires the person—

• (a) to take steps specified in the notice, or

• (b) to refrain from taking steps specified in the notice,

or both (and see also sections 150 and 151).

• (2) The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—

• (a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);

• (b) a provision of or made under Articles 12 to 22D of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;

• (c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);

• (d) a requirement to communicate a personal data breach to the Commissioner or a data subject under section 67, 68 or 108 of this Act;

• (e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44A to 49A of the UK GDPR or in sections 73 to 78 or 109 of this Act.

• (3) The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the UK GDPR (monitoring of approved codes of conduct).

• (4) The third type of failure is where a person who is a certification provider—

• (a) does not meet the requirements for accreditation,

• (b) has failed, or is failing, to comply with an obligation under Article 42 or 43 of the UK GDPR (certification of controllers and processors), or

• (c) has failed, or is failing, to comply with any other provision of the UK GDPR (whether in the person's capacity as a certification provider or otherwise).

• (5) The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.

• (6) An enforcement notice given in reliance on subsection (2), (3) or (5) may only impose requirements which the Commissioner considers appropriate for the purpose of remedying the failure.

• (7) An enforcement notice given in reliance on subsection (4) may only impose requirements which the Commissioner considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).

• (8) The Secretary of State may by regulations confer power on the Commissioner to give an enforcement notice in respect of other failures to comply with the data protection legislation.

• (9) Regulations under this section—

• (a) may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,

• (b) may make provision about the giving of an information notice, an assessment notice , an interview notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 , 148A, 148B and 155 to 157 and Schedules 15 and 16, and

• (c) are subject to the affirmative resolution procedure.

Enforcement notices: supplementary

150

• (1) An enforcement notice must—

• (a) state what the person has failed or is failing to do, and

• (b) give the Commissioner's reasons for reaching that opinion.

• (2) In deciding whether to give an enforcement notice in reliance on section 149(2), the Commissioner must consider whether the failure has caused or is likely to cause any person damage or distress.

• (3) In relation to an enforcement notice given in reliance on section 149(2), the Commissioner's power under section 149(1)(b) to require a person to refrain from taking specified steps includes power—

• (a) to impose a ban relating to all processing of personal data, or

• (b) to impose a ban relating only to a specified description of processing of personal data, including by specifying one or more of the following—

• (i) a description of personal data;

• (ii) the purpose or manner of the processing;

• (iii) the time when the processing takes place.

• (4) An enforcement notice may specify the time or times at which, or period or periods within which, a requirement imposed by the notice must be complied with (but see the restrictions in subsections (6) to (8)).

• (5) An enforcement notice must provide information about—

• (a) the consequences of failure to comply with it, and

• (b) the rights under sections 162 and 164 (appeals etc).

• (6) An enforcement notice must not specify a time for compliance with a requirement in the notice which falls before the end of the period within which an appeal can be brought against the notice.

• (7) If an appeal is brought against an enforcement notice, a requirement in the notice need not be complied with pending the determination or withdrawal of the appeal.

• (8) If an enforcement notice—

• (a) states that, in the Commissioner's opinion, it is necessary for a requirement to be complied with urgently, and

• (b) gives the Commissioner's reasons for reaching that opinion,

subsections (6) and (7) do not apply but the notice must not require the requirement to be complied with before the end of the period of 24 hours beginning when the notice is given.

• (9) In this section, “specified” means specified in an enforcement notice.

Enforcement notices: rectification and erasure of personal data etc

151

• (1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor—

• (a) to comply with a data protection principle relating to accuracy, or

• (b) to comply with a data subject's request to exercise rights under Article 16, 17 or 18 of the UK GDPR (right to rectification, erasure or restriction on processing) or section 46, 47 or 100 of this Act.

• (2) If the enforcement notice requires the controller or processor to rectify or erase inaccurate personal data, it may also require the controller or processor to rectify or erase any other data which—

• (a) is held by the controller or processor, and

• (b) contains an expression of opinion which appears to the Commissioner to be based on the inaccurate personal data.

• (3) Where a controller or processor has accurately recorded personal data provided by the data subject or a third party but the data is inaccurate, the enforcement notice may require the controller or processor—

• (a) to take steps specified in the notice to ensure the accuracy of the data,

• (b) if relevant, to secure that the data indicates the data subject's view that the data is inaccurate, and

• (c) to supplement the data with a statement of the true facts relating to the matters dealt with by the data that is approved by the Commissioner,

(as well as imposing requirements under subsection (2)).

• (4) When deciding what steps it is reasonable to specify under subsection (3)(a), the Commissioner must have regard to the purpose for which the data was obtained and further processed.

• (5) Subsections (6) and (7) apply where—

• (a) an enforcement notice requires a controller or processor to rectify or erase personal data, or

• (b) the Commissioner is satisfied that the processing of personal data which has been rectified or erased by the controller or processor involved a failure described in subsection (1).

• (6) An enforcement notice may, if reasonably practicable, require the controller or processor to notify third parties to whom the data has been disclosed of the rectification or erasure.

• (7) In determining whether it is reasonably practicable to require such notification, the Commissioner must have regard, in particular, to the number of people who would have to be notified.

• (8) In this section, “data protection principle relating to accuracy” means the principle in—

• (a) Article 5(1)(d) of the UK GDPR,

• (b) section 38(1) of this Act, or

• (c) section 89 of this Act.

Enforcement notices: restrictions

152

• (1) The Commissioner may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—

• (a) a determination under section 174 with respect to the data or the processing has taken effect, and

• (b) a court has granted leave for the notice to be given.

• (2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—

• (a) the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and

• (b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.

• (3) An enforcement notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.