The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

Enforcement powers

2.—(1) The sections referred to in paragraph 1 are to apply as if—

(a) for “data controller”, on each occasion that it appears, there were substituted “trust service provider”;

(b) for “data protection principles” or “data protection principle or principles”, on each occasion they appear, there were substituted “requirements of Chapter III of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (in this Part referred to as “the relevant requirements”)”; and

(c) for “principle or principles”, on each occasion that it appears, (otherwise than as set out in paragraph (b)), there were substituted “requirements”.

(2) Section 40 is to apply as if—

(a) in subsection (2), the words “or distress” were omitted;

(b) in subsection (6)(a), for “his” there were substituted “the Commissioner’s”;

(c) in subsection (8), for “he” there were substituted “the Commissioner”;

(d) subsections (3), (4), (5), (9) and (10) were omitted.

(3) Section 41(1) is to apply as if for “he” there were substituted “the Commissioner”.

(4) Section 41A is to apply as if—

(a) in subsection (1) the words “within subsection (2)” were omitted;

(b) subsections (2), (8), (9), (10), (11) and (12) were omitted; and

(c) subsections (3)(g) and (h) were omitted.

(5) Section 41B is to apply as if in subsections 3(a) and 3(b), for “this Act”, there were substituted “Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market”.

(6) Section 41C is to apply as if subsection (7) were omitted.

(7) Section 43 is to apply as if—

(a) for subsections (1) and (2) there were substituted—

“(1) If the Commissioner reasonably requires any information for the purpose of determining whether a trust service provider has complied or is complying with the relevant requirements, it may serve the trust service provider with a notice (in this Act referred to as “an information notice”).

(2) An information notice must require the trust service provider, within such time as is specified in the notice, to furnish the Commissioner, in such form as may be so specified, with such information relating to compliance with the relevant requirements as is so specified.

(3) An information notice must contain a statement that the Commissioner regards the specified information as relevant for the purpose of determining whether the trust service provider has complied or is complying with the relevant requirements and the Commissioner’s reason for regarding it as relevant for that purpose.”;

(b) in subsection (1A), for “in subsection (1)” there were substituted “in subsection (3)”;

(c) in subsection (5), for “he” there were substituted “the Commissioner”;

(d) in subsection (6) for “this Act” there were substituted “Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market”;

(e) in subsections (8) and (8B) for “this Act”, on each occasion that it appears, there were substituted “this Act as applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016”; and

(f) subsection (10) were omitted.

(8) Section 47 is to apply as if—

(a) in subsection (1), for “, an information notice or special information notice”, there were substituted “or an information notice”;

(b) in subsection (2) the words “or a special information notice” were omitted; and

(c) after subsection (3) there were inserted—

“(4) The Commissioner may serve a trust service provider with a withdrawal notice if the Commissioner—

(a) has served a qualified trust service provider with an enforcement notice or an information notice;

(b) the qualified trust service provider has failed to comply with such notice within the period specified; and

(c) there is no pending appeal against such notice.

(5) In subsection (4), “withdrawal notice” means a notice withdrawing the qualified status from a trust service provider or the qualified status of a service provided by the trust service provider.”.

(9) Section 48 is to apply as if—

(a) in subsection (1), for “special information”, there were substituted “withdrawal”;

(b) in subsection (3)—

(i) for “, an information notice or special information notice” there were substituted “or an information notice”; and

(ii) the words “or 44(6)” were omitted;

(c) subsection (4) were omitted.

(10) Section 49 is to apply as if subsection (5) were omitted.

(11) Section 60 is to apply as if—

(a) for “this Act”, on each occasion that it appears, there were substituted “this Act, as applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016”;

(b) in subsection (2), the words “section 54A and” were omitted;

(c) in subsection (3), the words “section 54A and” were omitted; and

(d) in subsection (4), subsections (a) and (b) were omitted.

(12) Schedule 6, paragraph 7, is to apply as if—

(a) for sub-paragraph (1), there were substituted “Tribunal Procedural Rules may make provision for regulating the exercise of the rights of appeal conferred by section 48 of this Act”; and

(b) in sub-paragraph (2) the words “and the Freedom of Information Act 2000” were omitted.

(13) Schedule 9 is to apply as if—

(a) in paragraph 1—

(i) for sub-paragraph (1)(a) there were substituted—

“(a) that a trust service provider has contravened or is contravening any of the requirements of Chapter III of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market (in this Schedule referred to as “the relevant requirements”), or ”;

(ii) in sub-paragraph (1)(b)—

(aa) for “this Act” there were substituted “this Act as applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016”;

(bb) the words “subject to sub-paragraph (2) and paragraph 2” were omitted;

(iii) in sub-paragraph (1B), the words “; but this is subject to sub-paragraph (2) and paragraph 2” were omitted;

(iv) sub-paragraph (2) were omitted;

(v) in sub-paragraph (3)(c) the words “which is used or intended to be used for the processing of personal data” were omitted;

(b) paragraph 8 were omitted; and

(c) in paragraph 9, for “this Act”, on each occasion that it appears, there were substituted “Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market”.