(1) A failure by a person to act in accordance with a provision of a code issued under section 125(4) does not of itself make that person liable to legal proceedings in a court or tribunal.
(2) A code issued under section 125(4), including an amendment or replacement code, is admissible in evidence in legal proceedings.
(3) In any proceedings before a court or tribunal, the court or tribunal must take into account a provision of a code issued under section 125(4) in determining a question arising in the proceedings if—
(a) the question relates to a time when the provision was in force, and
(b) the provision appears to the court or tribunal to be relevant to the question.
(4) Where the Commission is carrying out a function described in subsection (5), the Commission must take into account a provision of a code issued under section 125(4) in determining a question arising in connection with the carrying out of the function if—
(a) the question relates to a time when the provision was in force, and
(b) the provision appears to the Commission to be relevant to the question.
(5) Those functions are functions under—
(a) the data protection legislation, or
(b) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).
(1) The Commission's functions under Article 58(1) of the UK GDPR and paragraph 1 of Schedule 13 include power, with the consent of a controller or processor, to carry out an assessment of whether the controller or processor is complying with good practice in the processing of personal data.
(2) The Commission must inform the controller or processor of the results of such an assessment.
(3) In this section, “good practice in the processing of personal data” has the same meaning as in section 124A.
(1) A Minister of the Crown who issues a certificate under section 27, 79 or 111 must send a copy of the certificate to the Commission.
(2) If the Commission receives a copy of a certificate under subsection (1), the Commission must publish a record of the certificate.
(3) The record must contain—
(a) the name of the Minister who issued the certificate,
(b) the date on which the certificate was issued, and
(c) subject to subsection (4), the text of the certificate.
(4) The Commission must not publish the text, or a part of the text, of the certificate if—
(a) the Minister determines that publishing the text or that part of the text—
(i) would be against the interests of national security,
(ii) would be contrary to the public interest, or
(iii) might jeopardise the safety of any person, and
(b) the Minister has notified the Commission of that determination.
(5) The Commission must keep the record of the certificate available to the public while the certificate is in force.
(6) If a Minister of the Crown revokes a certificate issued under section 27, 79 or 111, the Minister must notify the Commission.
(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the Commission with information necessary for the discharge of the Commission's functions.
(2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.
(1) A person who is or has been a member of the Commission or a member of its staff, or an agent of the Commission, must not disclose information which—
(a) has been obtained by, or provided to, the Commission in the course of, or for the purposes of, the discharging of the Commission's functions,
(b) relates to an identified or identifiable individual or business, and
(c) is not available to the public from other sources at the time of the disclosure and has not previously been available to the public from other sources,
unless the disclosure is made with lawful authority.
(2) For the purposes of subsection (1), a disclosure is made with lawful authority only if and to the extent that—
(a) the disclosure was made with the consent of the individual or of the person for the time being carrying on the business,
(b) the information was obtained or provided as described in subsection (1)(a) for the purpose of its being made available to the public (in whatever manner),
(c) the disclosure was made for the purposes of, and is necessary for, the discharge of one or more of the Commission's functions,
(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(e) the disclosure was made for the purposes of criminal or civil proceedings, however arising, or
(f) having regard to the rights, freedoms and legitimate interests of any person, the disclosure was necessary in the public interest.
(3) It is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).
(1) The Commission must produce and publish guidance about—
(a) how the Commission proposes to secure that privileged communications which the Commission obtains or has access to in the course of carrying out the Commission's functions are used or disclosed only so far as necessary for carrying out those functions, and
(b) how the Commission proposes to comply with restrictions and prohibitions on obtaining or having access to privileged communications which are imposed by an enactment.
(2) The Commission—
(a) may alter or replace the guidance, and
(b) must publish any altered or replacement guidance.
(3) The Commission must consult the Secretary of State before publishing guidance under this section (including altered or replacement guidance).
(4) The Commission must arrange for guidance under this section (including altered or replacement guidance) to be laid before Parliament.
(5) In this section, “privileged communications” means—
(a) communications made—
(i) between a professional legal adviser and the adviser's client, and
(ii) in connection with the giving of legal advice to the client with respect to legal obligations, liabilities or rights, and
(b) communications made—
(i) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
(ii) in connection with or in contemplation of legal proceedings, and
(iii) for the purposes of such proceedings.
(6) In subsection (5)—
(a) references to the client of a professional legal adviser include references to a person acting on behalf of the client, and
(b) references to a communication include—
(i) a copy or other record of the communication, and
(ii) anything enclosed with or referred to in the communication if made as described in subsection (5)(a)(ii) or in subsection (5)(b)(ii) and (iii).
The Commission may require a person other than a data subject or a data protection officer to pay a reasonable fee for a service provided to the person, or at the person's request, which the Commission is required or authorised to provide under the data protection legislation.
135 Manifestly unfounded or excessive requests by data subjects etc
(A1) This section makes provision about cases in which a request made to the Commission, to which the Commission is required or authorised to respond under the data protection legislation, is manifestly unfounded or excessive.
(1) ... The Commission may—
(a) charge a reasonable fee for dealing with the request, or
(b) refuse to act on the request.
(1A) In subsection (1)—
(a) the reference in paragraph (a) to charging a reasonable fee is, in a case in which section 134 is relevant, a reference to doing so under that section, and
(b) paragraph (b) is not to be read as implying anything about whether the Commission may refuse to act on requests that are neither manifestly unfounded nor excessive.
(2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
(3) In any proceedings where there is an issue as to whether a request described in subsection A1 is manifestly unfounded or excessive, it is for the Commission to show that it is.
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(5) Article 57(3) of the UK GDPR (performance of Commission's tasks generally to be free of charge for data subject) has effect subject to this section.
(1) The Commission must produce and publish guidance about the fees the Commission proposes to charge in accordance with—
(a) section 134 or 135, ...
(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) Before publishing the guidance, the Commission must consult the Secretary of State.
137 Charges payable to the Commission by controllers
(1) The Secretary of State may by regulations require controllers to pay charges of an amount specified in the regulations to the Commission.
(2) Regulations under subsection (1) may require a controller to pay a charge regardless of whether the Commission has provided, or proposes to provide, a service to the controller.
(3) Regulations under subsection (1) may—
(a) make provision about the time or times at which, or period or periods within which, a charge must be paid;
(b) make provision for cases in which a discounted charge is payable;
(c) make provision for cases in which no charge is payable;
(d) make provision for cases in which a charge which has been paid is to be refunded.
(4) In making regulations under subsection (1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Commission under such regulations are sufficient to offset—
(a) expenses incurred by the Commission in discharging the Commission's functions—
(i) under the data protection legislation,
(ii) under the Data Protection Act 1998,
(iii) under or by virtue of sections 108 and 109 of the Digital Economy Act 2017, and
(iv) under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426),
(b) any expenses of the Secretary of State in respect of the Commission so far as attributable to those functions,
(c) to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and
(d) to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commission in any scheme under section 1 of the Superannuation Act 1972 or section 1 of the Public Service Pensions Act 2013.
(5) The Secretary of State may from time to time require the Commission to provide information about the expenses referred to in subsection (4)(a).
(6) The Secretary of State may by regulations make provision—
(a) requiring a controller to provide information to the Commission, or
(b) enabling the Commission to require a controller to provide information to the Commission,
for either or both of the purposes mentioned in subsection (7).
(7) Those purposes are—
(a) determining whether a charge is payable by the controller under regulations under subsection (1);
(b) determining the amount of a charge payable by the controller.
(8) The provision that may be made under subsection (6)(a) includes provision requiring a controller to notify the Commission of a change in the controller's circumstances of a kind specified in the regulations.
(1) Before making regulations under section 137(1) or (6), the Secretary of State must consult such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate (and see also section 182).
(2) The Commission —
(a) must keep under review the working of regulations under section 137(1) or (6), and
(b) may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.
(3) The Secretary of State must review the working of regulations under section 137(1) or (6)—
(a) at the end of the period of 5 years beginning with the making of the first set of regulations under section 108 of the Digital Economy Act 2017, and
(b) at the end of each subsequent 5 year period.
(4) Regulations under section 137(1) are subject to the negative resolution procedure if—
(a) they only make provision increasing a charge for which provision is made by previous regulations under section 137(1) or section 108(1) of the Digital Economy Act 2017, and
(b) they do so to take account of an increase in the retail prices index since the previous regulations were made.
(5) Subject to subsection (4), regulations under section 137(1) or (6) are subject to the affirmative resolution procedure.
(6) In subsection (4), “the retail prices index” means—
(a) the general index of retail prices (for all items) published by the Statistics Board, or
(b) where that index is not published for a month, any substitute index or figures published by the Board.
(7) Regulations under section 137(1) or (6) may not apply to—
(a) Her Majesty in her private capacity,
(b) Her Majesty in right of the Duchy of Lancaster, or
(c) the Duke of Cornwall.
(1) The Commission must—
(a) produce a general report on the carrying out of the Commission's functions annually,
(b) arrange for it to be laid before Parliament, and
(c) publish it.
(1A) In connection with the Commission's functions under the data protection legislation, the report must contain (among other things)—
(a) a review of what the Commission has done during the reporting period to comply with the duties under—
(i) sections 120A and 120B,
(ii) section 108 of the Deregulation Act 2015, and
(iii) section 21 of the Legislative and Regulatory Reform Act 2006,
including a review of the operation of the strategy prepared and published under section 120C;
(b) a review of what the Commission has done during the reporting period to comply with the duty under section 120D.
(1B) In subsection (1A), “the reporting period” means the period to which the report relates.
(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2A) The report under this section may include the annual report under section 161A.
(3) The Commission may produce other reports relating to the carrying out of the Commission's functions and arrange for them to be laid before Parliament.
(1) The Commission must prepare and publish an analysis of the Commissioner’s performance using key performance indicators.
(2) The analysis must be prepared and published at least annually.
(3) In this section, “key performance indicators” means factors by reference to which the Commission's performance can be measured most effectively.
A duty under this Act for the Commission to publish a document is a duty for the Commission to publish it, or to arrange for it to be published, in such form and manner as the Commission considers appropriate.
(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commission.
(2) The notice may be given to the person by—
(a) delivering it by hand to a relevant individual,
(b) leaving it at the person’s proper address,
(c) sending it by post to the person at that address, or
(d) sending it by email to the person’s email address.
(3) A “relevant individual” means—
(a) in the case of a notice to an individual, that individual;
(b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;
(c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;
(d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.
(4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—
(a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;
(b) in any other case, the address determined in accordance with subsection (5).
(5) The address is—
(a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;
(b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;
(c) in any other case, an address in the United Kingdom at which the Commission believes, on reasonable grounds, that the notice will come to the attention of the person.
(6) A person’s email address is—
(a) an email address published for the time being by that person as an address for contacting that person, or
(b) if there is no such published address, an email address by means of which the Commission believes, on reasonable grounds, that the notice will come to the attention of that person.
(7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
(8) In this section, “officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.
(9) This section does not limit other lawful means of giving a notice.
(1) The Commission may, by written notice (an “information notice”)—
(a) require a controller or processor to provide the Commission with information or documents that the Commission reasonably requires for the purposes of carrying out the Commission's functions under the data protection legislation, or
(b) require any person to provide the Commission with information or documents that the Commission reasonably requires for the purposes of—
(i) investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
(ii) determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.
(2) An information notice must state—
(a) whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
(b) why the Commission requires the information or documents.
(3) An information notice—
(a) may specify or describe particular information or documents or a category of information or documents;
(b) may specify the form in which the information or documents must be provided;
(c) may specify the time at which, or the period within which, the information or documents must be provided;
(d) may specify the place where the information or documents must be provided;
(but see the restrictions in subsections (5) to (7)).
(4) An information notice must provide information about—
(a) the consequences of failure to comply with it, and
(b) the rights under sections 162 and 164 (appeals etc).
(5) An information notice may not require a person to provide information or documents before the end of the period within which an appeal can be brought against the notice.
(6) If an appeal is brought against an information notice, the information or documents need not be provided pending the determination or withdrawal of the appeal.
(7) If an information notice—
(a) states that, in the Commission's opinion, the informationor documents are required urgently, and
(b) gives the Commission's reasons for reaching that opinion,
subsections (5) and (6) do not apply but the notice must not require the information or documents to be provided before the end of the period of 24 hours beginning when the notice is given.
(8) The Commission may cancel an information notice by written notice to the person to whom it was given.
(9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the UK GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the UK GDPR (representatives of controllers or processors not established in the United Kingdom).
(10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).
(1) The Commission may not give an information notice with respect to the processing of personal data for the special purposes unless—
(a) a determination under section 174 with respect to the data or the processing has taken effect, or
(b) the Commission—
(i) has reasonable grounds for suspecting that such a determination could be made, and
(ii) the information or documents are required for the purposes of making such a determination.
(2) An information notice does not require a person to give the Commission information or documents to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
(3) An information notice does not require a person to give the Commission information or documents to the extent that requiring the person to do so would result in the disclosure of a communication which is made—
(a) between a professional legal adviser and the adviser's client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
(4) An information notice does not require a person to give the Commission information or documents to the extent that requiring the person to do so would result in the disclosure of a communication which is made—
(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
(c) for the purposes of such proceedings.
(5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
(6) An information notice does not require a person to provide the Commission with information or documents if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
(7) The reference to an offence in subsection (6) does not include an offence under—
(a) this Act;
(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
(8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—
(a) in giving evidence the person provides information inconsistent with the statement, and
(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.
(9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the UK GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.
144 False statements made in response to information notices
It is an offence for a person, in response to an information notice—
(a) to make a statement which the person knows to be false in a material respect, or
(b) recklessly to make a statement which is false in a material respect.
(1) This section applies if, on an application by the Commission, a court is satisfied that a person has failed to comply with a requirement of an information notice.
(2) The court may make an order requiring the person to provide to the Commission some or all of the following—
(a) information or documents referred to in the information notice;
(b) other information or documents which the court is satisfied the Commission requires, having regard to the statement included in the notice in accordance with section 142(2)(b).
(3) The order—
(a) may specify the form in which the information or documents must be provided,
(b) must specify the time at which, or the period within which, the information or documents must be provided, and
(c) may specify the place where the information or documents must be provided.
(1) The Commission may by written notice (an “assessment notice”) require a controller or processor to permit the Commission to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.
(2) An assessment notice may require the controller or processor to do any of the following—
(a) permit a member of the Commission or a member of its staff to enter specified premises;
(b) direct a member of the Commission or a member of its staff to documents on the premises that are of a specified description;
(c) assist a member of the Commission or a member of its staff to view information of a specified description that is capable of being viewed using equipment on the premises;
(d) comply with a request from a member of the Commission or a member of its staff for a copy (in such form as may be requested) of—
(i) the documents to which that person is directed under paragraph (b);
(ii) the information which that person is assisted to view under paragraph (c);
(e) direct a member of the Commission or a member of its staff to equipment or other material on the premises which is of a specified description;
(f) permit a member of the Commission or a member of its staff to inspect or examine the documents, information, equipment or material to which that person is directed under paragraph (b) or which that person is assisted to view under paragraph (c);
(g) provide a member of the Commission or a member of its staff with an explanation of such documents, information, equipment or material;
(h) permit a member of the Commission or a member of its staff to observe the processing of personal data that takes place on the premises;
(i) make available for interview by a member of the Commission or a member of its staff a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed;
(j) make arrangements for an approved person to prepare a report on a specified matter;
(k) provide to the Commission a report prepared in pursuance of such arrangements.
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(3A) An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—
(a) the preparation of the report;
(b) the contents of the report;
(c) the form in which the report is to be provided;
(d) the date by which the report is to be completed.
(4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).
(5) An assessment notice must provide information about—
(a) the consequences of failure to comply with it, and
(b) the rights under sections 162 and 164 (appeals etc).
(6) An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.
(7) If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.
(8) If an assessment notice—
(a) states that, in the Commission's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently,
(b) gives the Commission's reasons for reaching that opinion, and
(c) does not meet the conditions in subsection (9)(a) to (d),
subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.
(9) If an assessment notice—
(a) states that, in the Commission's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed,
(b) indicates the nature of the suspected failure or offence,
(c) does not specify domestic premises,
(d) states that, in the Commission's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and
(e) gives the Commission's reasons for reaching that opinion,
subsections (6) and (7) do not apply.
(10) The Commission may cancel an assessment notice by written notice to the controller or processor to whom it was given.
(11) Where the Commission gives an assessment notice to a processor, the Commission must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.
(11A) Where the Commission gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.
(12) In this section—
“approved person”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;
“domestic premises” means premises, or a part of premises, used as a dwelling;
“specified” means specified in an assessment notice.
146A Assessment notices: approval of person to prepare report etc
(1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report.
(2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commission a person to prepare the report.
(3) If the Commission is satisfied that the nominated person is a suitable person to prepare the report, the Commission must by written notice to the controller or processor approve the nominated person to prepare the report.
(4) If the Commission is not satisfied that the nominated person is a suitable person to prepare the report, the Commission must by written notice to the controller or processor—
(a) inform the controller or processor that the Commission has decided not to approve the nominated person to prepare the report,
(b) inform the controller or processor of the reasons for that decision, and
(c) approve a person who the Commission is satisfied is a suitable person to prepare the report to do so.
(5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commission must by written notice to the controller or processor approve a person who the Commission is satisfied is a suitable person to prepare the report to do so.
(6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.
(1) An assessment notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.
(2) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—
(a) between a professional legal adviser and the adviser's client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
(3) An assessment notice does not have effect so far as compliance would result in the disclosure of a communication which is made—
(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
(c) for the purposes of such proceedings.
(4) In subsections (2) and (3)—
(a) references to the client of a professional legal adviser include references to a person acting on behalf of such a client, and
(b) references to a communication include—
(i) a copy or other record of the communication, and
(ii) anything enclosed with or referred to in the communication if made as described in subsection (2)(b) or in subsection (3)(b) and (c).
(5) The Commission may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes.
(6) The Commission may not give an assessment notice to—
(a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), ...
(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
148 Destroying or falsifying information and documents etc
(1) This section applies where a person—
(a) has been given an information notice requiring the person to provide the Commission with information or a document, or
(b) has been given an assessment notice requiring the person to direct a member of the Commission or a member of its staff to a document, equipment or other material or to assist such a person to view information.
(2) It is an offence for the person—
(a) to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material, or
(b) to cause or permit the destruction, disposal, concealment, blocking or (where relevant) falsification of all or part of the information, document, equipment or material,
with the intention of preventing a member of the Commission or a member of its staff from viewing, or being provided with or directed to, all or part of the information, document, equipment or material.
(3) It is a defence for a person charged with an offence under subsection (2) to prove that the destruction, disposal, concealment, blocking or falsification would have occurred in the absence of the person being given the notice.
(1) This section applies where the Commission suspects that a controller or processor—
(a) has failed or is failing as described in section 149(2), or
(b) has committed or is committing an offence under this Act.
(2) For the purpose of investigating the suspected failure or offence, the Commission may, by written notice (an “interview notice”), require an individual within subsection (3) to—
(a) attend at a place specified in the notice, and
(b) answer questions with respect to any matter relevant to the investigation.
(3) An individual is within this subsection if the individual—
(a) is the controller or processor,
(b) is or was at any time employed by, or otherwise working for, the controller or processor, or
(c) is or was at any time concerned in the management or control of the controller or processor.
(4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)).
(5) An interview notice must—
(a) indicate the nature of the suspected failure or offence that is the subject of the investigation,
(b) provide information about the consequences of failure to comply with the notice, and
(c) provide information about the rights under sections 162 and 164 (appeals etc).
(6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice.
(7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal.
(8) If an interview notice—
(a) states that, in the Commission's opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and
(b) gives the Commission's reasons for reaching that opinion,
subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given.
(9) The Commission may cancel or vary an interview notice by written notice to the individual to whom it was given.
(1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
(2) An interview notice does not require an individual to answer questions in respect of a communication which is made—
(a) between a professional legal adviser and the adviser’s client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
(3) An interview notice does not require an individual to answer questions in respect of a communication which is made—
(a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,
(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
(c) for the purposes of such proceedings.
(4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
(5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence.
(6) The reference to an offence in subsection (5) does not include an offence under—
(a) this Act;
(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
(7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings—
(a) in giving evidence the individual provides information inconsistent with the statement, and
(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf.
(8) The Commission may not give an interview notice with respect to the processing of personal data for the special purposes.
(9) The Commission may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters).
148C False statements made in response to interview notices
It is an offence for an individual, in response to an interview notice—
(a) to make a statement which the individual knows to be false in a material respect, or
(b) recklessly to make a statement which is false in a material respect.
(1) Where the Commission is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) , (5) or (5A), the Commission may give the person a written notice (an “enforcement notice”) which requires the person—
(a) to take steps specified in the notice, or
(b) to refrain from taking steps specified in the notice,
or both (and see also sections 150 and 151).
(2) The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following—
(a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
(b) a provision of or made under Articles 12 to 22D of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
(c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);
(d) a requirement to communicate a personal data breach to the Commission or a data subject under section 67, 68 or 108 of this Act;
(e) the principles for transfers of personal data to third countries, non-Convention countries and international organisations in Articles 44A to 49A of the UK GDPR or in sections 73 to 78 or 109 of this Act.
(3) The second type of failure is where a monitoring body has failed, or is failing, to comply with an obligation under Article 41 of the UK GDPR (monitoring of approved codes of conduct).
(4) The third type of failure is where a person who is a certification provider—
(a) does not meet the requirements for accreditation,
(b) has failed, or is failing, to comply with an obligation under Article 42 or 43 of the UK GDPR (certification of controllers and processors), or
(c) has failed, or is failing, to comply with any other provision of the UK GDPR (whether in the person's capacity as a certification provider or otherwise).
(5) The fourth type of failure is where a controller has failed, or is failing, to comply with regulations under section 137.
(5A) The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B.
(6) An enforcement notice given in reliance on subsection (2), (3) , (5) or (5A) may only impose requirements which the Commission considers appropriate for the purpose of remedying the failure.
(7) An enforcement notice given in reliance on subsection (4) may only impose requirements which the Commission considers appropriate having regard to the failure (whether or not for the purpose of remedying the failure).
(8) The Secretary of State may by regulations confer power on the Commission to give an enforcement notice in respect of other failures to comply with the data protection legislation.
(9) Regulations under this section—
(a) may make provision about the giving of an enforcement notice in respect of the failure, including by amending this section and sections 150 to 152,
(b) may make provision about the giving of an information notice, an assessment notice , an interview notice or a penalty notice, or about powers of entry and inspection, in connection with the failure, including by amending sections 142, 143, 146, 147 , 148A, 148B and 155 to 157 and Schedules 15 and 16, and
(c) are subject to the affirmative resolution procedure.
(1) An enforcement notice must—
(a) state what the person has failed or is failing to do, and
(b) give the Commission's reasons for reaching that opinion.
(2) In deciding whether to give an enforcement notice in reliance on section 149(2), the Commission must consider whether the failure has caused or is likely to cause any person damage or distress.
(3) In relation to an enforcement notice given in reliance on section 149(2), the Commission's power under section 149(1)(b) to require a person to refrain from taking specified steps includes power—
(a) to impose a ban relating to all processing of personal data, or
(b) to impose a ban relating only to a specified description of processing of personal data, including by specifying one or more of the following—
(i) a description of personal data;
(ii) the purpose or manner of the processing;
(iii) the time when the processing takes place.
(4) An enforcement notice may specify the time or times at which, or period or periods within which, a requirement imposed by the notice must be complied with (but see the restrictions in subsections (6) to (8)).
(5) An enforcement notice must provide information about—
(a) the consequences of failure to comply with it, and
(b) the rights under sections 162 and 164 (appeals etc).
(6) An enforcement notice must not specify a time for compliance with a requirement in the notice which falls before the end of the period within which an appeal can be brought against the notice.
(7) If an appeal is brought against an enforcement notice, a requirement in the notice need not be complied with pending the determination or withdrawal of the appeal.
(8) If an enforcement notice—
(a) states that, in the Commission's opinion, it is necessary for a requirement to be complied with urgently, and
(b) gives the Commission's reasons for reaching that opinion,
subsections (6) and (7) do not apply but the notice must not require the requirement to be complied with before the end of the period of 24 hours beginning when the notice is given.
(9) In this section, “specified” means specified in an enforcement notice.
151 Enforcement notices: rectification and erasure of personal data etc
(1) Subsections (2) and (3) apply where an enforcement notice is given in respect of a failure by a controller or processor—
(a) to comply with a data protection principle relating to accuracy, or
(b) to comply with a data subject's request to exercise rights under Article 16, 17 or 18 of the UK GDPR (right to rectification, erasure or restriction on processing) or section 46, 47 or 100 of this Act.
(2) If the enforcement notice requires the controller or processor to rectify or erase inaccurate personal data, it may also require the controller or processor to rectify or erase any other data which—
(a) is held by the controller or processor, and
(b) contains an expression of opinion which appears to the Commission to be based on the inaccurate personal data.
(3) Where a controller or processor has accurately recorded personal data provided by the data subject or a third party but the data is inaccurate, the enforcement notice may require the controller or processor—
(a) to take steps specified in the notice to ensure the accuracy of the data,
(b) if relevant, to secure that the data indicates the data subject's view that the data is inaccurate, and
(c) to supplement the data with a statement of the true facts relating to the matters dealt with by the data that is approved by the Commission,
(as well as imposing requirements under subsection (2)).
(4) When deciding what steps it is reasonable to specify under subsection (3)(a), the Commission must have regard to the purpose for which the data was obtained and further processed.
(5) Subsections (6) and (7) apply where—
(a) an enforcement notice requires a controller or processor to rectify or erase personal data, or
(b) the Commission is satisfied that the processing of personal data which has been rectified or erased by the controller or processor involved a failure described in subsection (1).
(6) An enforcement notice may, if reasonably practicable, require the controller or processor to notify third parties to whom the data has been disclosed of the rectification or erasure.
(7) In determining whether it is reasonably practicable to require such notification, the Commission must have regard, in particular, to the number of people who would have to be notified.
(8) In this section, “data protection principle relating to accuracy” means the principle in—
(a) Article 5(1)(d) of the UK GDPR,
(b) section 38(1) of this Act, or
(c) section 89 of this Act.
(1) The Commission may not give a controller or processor an enforcement notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
(a) a determination under section 174 with respect to the data or the processing has taken effect, and
(b) a court has granted leave for the notice to be given.
(2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
(a) the Commission has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
(b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
(3) An enforcement notice does not require a person to do something to the extent that requiring the person to do it would involve an infringement of the privileges of either House of Parliament.
(4) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commission may only give the controller an enforcement notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
153 Enforcement notices: cancellation and variation
(1) The Commission may cancel or vary an enforcement notice by giving written notice to the person to whom it was given.
(2) A person to whom an enforcement notice is given may apply in writing to the Commission for the cancellation or variation of the notice.
(3) An application under subsection (2) may be made only—
(a) after the end of the period within which an appeal can be brought against the notice, and
(b) on the ground that, by reason of a change of circumstances, one or more of the provisions of that notice need not be complied with in order to remedy the failure identified in the notice.
(1) If the Commission is satisfied that a person—
(a) has failed or is failing as described in section 149(2), (3), (4) , (5) or (5A), ...
(b) has failed to comply with an information notice, an assessment notice , an interview notice or an enforcement notice , or
(c) has failed to comply with a duty imposed on the person by section 146A(6).
the Commission may, by written notice (a “penalty notice”), require the person to pay to the Commission an amount in sterling specified in the notice.
(2) Subject to subsection (4), when deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commission must have regard to the following, so far as relevant—
(a) to the extent that the notice concerns a matter to which the UK GDPR applies, the matters listed in Article 83(1) and (2) of the UK GDPR;
(b) to the extent that the notice concerns another matter, the matters listed in subsection (3).
(3) Those matters are—
(a) the nature, gravity and duration of the failure;
(b) the intentional or negligent character of the failure;
(c) any action taken by the controller or processor to mitigate the damage or distress suffered by data subjects;
(d) the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented by the controller or processor in accordance with section 57, 66, 103 or 107;
(e) any relevant previous failures by the controller or processor;
(f) the degree of co-operation with the Commission, in order to remedy the failure and mitigate the possible adverse effects of the failure;
(g) the categories of personal data affected by the failure;
(h) the manner in which the infringement became known to the Commission, including whether, and if so to what extent, the controller or processor notified the Commission of the failure;
(i) the extent to which the controller or processor has complied with previous enforcement notices or penalty notices;
(j) adherence to approved codes of conduct or certification mechanisms;
(k) any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly);
(l) whether the penalty would be effective, proportionate and dissuasive.
(4) Subsections (2) and (3) do not apply in the case of a decision or determination relating to a failure described in section 149(5).
(5) Schedule 16 makes further provision about penalty notices, including provision requiring the Commission to give a notice of intent to impose a penalty and provision about payment, variation, cancellation and enforcement.
(6) The Secretary of State may by regulations—
(a) confer power on the Commission to give a penalty notice in respect of other failures to comply with the data protection legislation, and
(b) provide for the maximum penalty that may be imposed in relation to such failures to be either the standard maximum amount or the higher maximum amount.
(7) Regulations under this section—
(a) may make provision about the giving of penalty notices in respect of the failure,
(b) may amend this section and sections 156 to 158, and
(c) are subject to the affirmative resolution procedure.
(8) In this section, “higher maximum amount” and “standard maximum amount” have the same meaning as in section 157.
(1) The Commission may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
(a) a determination under section 174 with respect to the data or the processing has taken effect, and
(b) a court has granted leave for the notice to be given.
(2) A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
(a) the Commission has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
(b) the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
(3) The Commission may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.
(4) The Commission may not give a penalty notice to—
(a) the Crown Estate Commissioners, or
(b) a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).
(5) In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commission may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
(1) In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is—
(a) the amount specified in Article 83 of the UK GDPR, or
(b) if an amount is not specified there, the standard maximum amount.
(2) In relation to an infringement of a provision of Part 3 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
(a) in relation to a failure to comply with section 35, 36, 37, 38(1), 39(1), 40, 44, 45, 46, 47, 48, 50B, 50C, 52, 53, 73, ... 75, 76, 77 or 78, the higher maximum amount, and
(b) otherwise, the standard maximum amount.
(3) In relation to an infringement of a provision of Part 4 of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is—
(a) in relation to a failure to comply with section 86, 87, 88, 89, 90, 91, 93, 94, 100 or 109, the higher maximum amount, and
(b) otherwise, the standard maximum amount.
(4) In relation to a failure to comply with an information notice, an assessment notice , an interview notice or an enforcement notice, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.
(4A) In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.
(5) The “higher maximum amount” is—
(a) in the case of an undertaking, £17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
(b) in any other case, £17,500,000.
(6) The “standard maximum amount” is—
(a) in the case of an undertaking, £8,700,000 or 2% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher, or
(b) in any other case, £8,700,000.
(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
158 Fixed penalties for non-compliance with charges regulations
(1) The Commission must produce and publish a document specifying the amount of the penalty for a failure to comply with regulations made under section 137.
(2) The Commission may specify different amounts for different types of failure.
(3) The maximum amount that may be specified is 150% of the highest charge payable by a controller in respect of a financial year in accordance with the regulations, disregarding any discount available under the regulations.
(4) The Commission—
(a) may alter or replace the document, and
(b) must publish any altered or replacement document.
(5) Before publishing a document under this section (including any altered or replacement document), the Commission must consult—
(a) the Secretary of State, and
(b) such other persons as the Commission considers appropriate.
(6) The Commission must arrange for a document published under this section (including any altered or replacement document) to be laid before Parliament.
(1) For the purposes of Article 83 of the UK GDPR and section 157, the Secretary of State may by regulations—
(a) provide that a person of a description specified in the regulations is or is not an undertaking, and
(b) make provision about how an undertaking's turnover is to be determined.
(2) For the purposes of Article 83 of the UK GDPR, section 157 and section 158, the Secretary of State may by regulations provide that a period is or is not a financial year.
(3) Regulations under this section are subject to the affirmative resolution procedure.
(1) The Commission must produce and publish guidance about how the Commission proposes to exercise the Commission's functions in connection with—
(a) information notices,
(b) assessment notices,
(ba) interview notices,
(c) enforcement notices, and
(d) penalty notices.
(2) The Commission may produce and publish guidance about how the Commission proposes to exercise the Commission's other functions under this Part.
(3) In relation to information notices, the guidance must include—
(a) provision specifying factors to be considered in determining the time at which, or the period within which, information or documents are to be required to be provided;
(b) provision about the circumstances in which the Commission would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);
(c) provision about how the Commission will determine how to proceed if a person does not comply with an information notice.
(4) In relation to assessment notices, the guidance must include—
(a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;
(aa) provision specifying factors to be considered in determining whether to give an assessment notice to a person that imposes a requirement of a sort mentioned in section 146(2)(j);
(ab) provision about the factors the Commission may take into account when determining the suitability of a person to prepare a report of a sort mentioned in section 146(2)(j);
(b) provision about the circumstances in which the Commission would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);
(c) provision specifying descriptions of documents or information that—
(i) are not to be examined or inspected in accordance with an assessment notice, or
(ii) are to be so examined or inspected only by a person of a description specified in the guidance;
(d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice;
(e) provision about the nature of interviews carried out in accordance with an assessment notice;
(f) provision about the preparation, issuing and publication by the Commission of assessment reports in respect of controllers and processors that have been given assessment notices;
(g) provision about how the Commission will determine how to proceed if a person does not comply with an assessment notice.
(5) The guidance produced in accordance with subsection (4)(c) must include provisions that relate to—
(a) documents and information concerning an individual's physical or mental health;
(b) documents and information concerning the provision of social care for an individual.
(5A) In relation to interview notices, the guidance must include—
(a) provision specifying factors to be considered in determining whether to give an interview notice to an individual;
(b) provision about the circumstances in which the Commission would consider it appropriate to give an interview notice to an individual in reliance on section 148A(8) (urgent cases);
(c) provision about the circumstances in which the Commission would consider it appropriate to vary the place or time specified in an interview notice at the request of the individual to whom the notice is given;
(d) provision about the nature of interviews carried out in accordance with an interview notice;
(e) provision about how the Commission will determine how to proceed if an individual does not comply with an interview notice.
(6) In relation to enforcement notices, the guidance must include—
(a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;
(b) provision about the circumstances in which the Commission would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases);
(c) provision about how the Commission will determine how to proceed if a person does not comply with an enforcement notice.
(7) In relation to penalty notices, the guidance must include—
(a) provision about the circumstances in which the Commission would consider it appropriate to issue a penalty notice;
(b) provision about the circumstances in which the Commission would consider it appropriate to allow a person to make oral representations about the Commission's intention to give the person a penalty notice;
(c) provision explaining how the Commission will determine the amount of penalties;
(d) provision about how the Commission will determine how to proceed if a person does not comply with a penalty notice.
(e) provision about the circumstances in which the Commission would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.
(8) The Commission—
(a) may alter or replace guidance produced under this section, and
(b) must publish any altered or replacement guidance.
(9) Before producing guidance under this section (including any altered or replacement guidance), the Commission must consult—
(a) the Secretary of State, and
(b) such other persons as the Commission considers appropriate.
(10) Section 161 applies in relation to the first guidance under subsection (1).
(11) The Commission must arrange for other guidance under this section (including any altered or replacement guidance) to be laid before Parliament.
(12) In this section, “social care” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).