Data Protection Act 2018

SCHEDULE 16 Penalties

Section 155 Meaning of “penalty” 1 In this Schedule, “penalty” means a penalty imposed by a penalty notice. Notice of intent to impose penalty 2 (1) Before giving a person a penalty notice, the Commission must, by written notice (a “notice of intent”) inform the person that the Commission intends to give a penalty notice. (2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Contents of notice of intent 3 (1) A notice of intent must contain the following information— (a) the name and address of the person to whom the Commission proposes to give a penalty notice; (b) the reasons why the Commission proposes to give a penalty notice (see sub-paragraph (2)); (c) an indication of the amount of the penalty the Commission proposes to impose, including any aggravating or mitigating factors that the Commission proposes to take into account. (2) The information required under sub-paragraph (1)(b) includes— (a) a description of the circumstances of the failure, and (b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure. (3) A notice of intent must also— (a) state that the person may make written representations about the Commission's intention to give a penalty notice, and (b) specify the period within which such representations may be made. (4) The period specified for making written representations must be a period of not less than 21 days beginning when the notice of intent is given. (5) If the Commission considers that it is appropriate for the person to have an opportunity to make oral representations about the Commission's intention to give a penalty notice, the notice of intent must also— (a) state that the person may make such representations, and (b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made. Giving a penalty notice 4 (A1) This paragraph applies where the Commission gives a notice of intent to a person. (A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person— (a) a penalty notice, or (b) written notice that the Commission has decided not to give a penalty notice to the person. (1) But the Commission may not give a penalty notice to the person before a time, or before the end of a period, specified in the notice of intent for making oral or written representations. (2) When deciding whether to give a penalty notice to the person and determining the amount of the penalty, the Commission must consider any oral or written representations made by the person in accordance with the notice of intent. Contents of penalty notice 5 (1) A penalty notice must contain the following information— (a) the name and address of the person to whom it is addressed; (b) details of the notice of intent given to the person; (c) whether the Commission received oral or written representations in accordance with the notice of intent; (d) the reasons why the Commission proposes to impose the penalty (see sub-paragraph (2)); (e) the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commission has taken into account; (f) details of how the penalty is to be paid; (g) details of the rights of appeal under section 162; (h) details of the Commission's enforcement powers under this Schedule. (2) The information required under sub-paragraph (1)(d) includes— (a) a description of the circumstances of the failure, and (b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure. Period for payment of penalty 6 (1) A penalty must be paid to the Commission within the period specified in the penalty notice. (2) The period specified must be a period of not less than 28 days beginning when the penalty notice is given. Variation of penalty 7 (1) The Commission may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given. (2) A penalty variation notice must specify— (a) the penalty notice concerned, and (b) how it is varied. (3) A penalty variation notice may not— (a) reduce the period for payment of the penalty; (b) increase the amount of the penalty; (c) otherwise vary the penalty notice to the detriment of the person to whom it was given. (4) If— (a) a penalty variation notice reduces the amount of the penalty, and (b) when that notice is given, an amount has already been paid that exceeds the amount of the reduced penalty, the Commission must repay the excess. Cancellation of penalty 8 (1) The Commission may cancel a penalty notice by giving written notice to the person to whom it was given. (2) If a penalty notice is cancelled, the Commission— (a) may not take any further action under section 155 or this Schedule in relation to the failure to which that notice relates, and (b) must repay any amount that has been paid in accordance with that notice. Enforcement of payment 9 (1) The Commission must not take action to recover a penalty unless— (a) the period specified in accordance with paragraph 6 has ended, (b) any appeals against the penalty notice have been decided or otherwise ended, (c) if the penalty notice has been varied, any appeals against the penalty variation notice have been decided or otherwise ended, and (d) the period for the person to whom the penalty notice was given to appeal against the penalty, and any variation of it, has ended. (2) In England and Wales, a penalty is recoverable— (a) if the county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court. (3) In Scotland, a penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland. (4) In Northern Ireland, a penalty is recoverable— (a) if a county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court.