xmlns:atom="http://www.w3.org/2005/Atom"

PART 6Enforcement

Information notices

142Information notices

(1)The Commissioner may, by written notice (an “information notice”)—

(a)require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner’s functions under the data protection legislation, or

(b)require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—

(i)investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or

(ii)determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

(2)An information notice must state—

(a)whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

(b)why the Commissioner requires the information.

(3)An information notice—

(a)may specify or describe particular information or a category of information;

(b)may specify the form in which the information must be provided;

(c)may specify the time at which, or the period within which, the information must be provided;

(d)may specify the place where the information must be provided;

(but see the restrictions in subsections (5) to (7)).

(4)An information notice must provide information about—

(a)the consequences of failure to comply with it, and

(b)the rights under sections 162 and 164 (appeals etc).

(5)An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.

(6)If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.

(7)If an information notice—

(a)states that, in the Commissioner’s opinion, the information is required urgently, and

(b)gives the Commissioner’s reasons for reaching that opinion,

subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.

(8)The Commissioner may cancel an information notice by written notice to the person to whom it was given.

(9)In subsection (1), in relation to a person who is a controller or processor for the purposes of the GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the GDPR (representatives of controllers or processors not established in the European Union).

(10)Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).

143Information notices: restrictions

(1)The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless—

(a)a determination under section 174 with respect to the data or the processing has taken effect, or

(b)the Commissioner—

(i)has reasonable grounds for suspecting that such a determination could be made, and

(ii)the information is required for the purposes of making such a determination.

(2)An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(3)An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

(a)between a professional legal adviser and the adviser’s client, and

(b)in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(4)An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

(a)between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,

(b)in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(c)for the purposes of such proceedings.

(5)In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(6)An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.

(7)The reference to an offence in subsection (6) does not include an offence under—

(a)this Act;

(b)section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(c)section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(d)Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(8)An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—

(a)in giving evidence the person provides information inconsistent with the statement, and

(b)evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person’s behalf.

(9)In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.

144False statements made in response to information notices

It is an offence for a person, in response to an information notice—

(a)to make a statement which the person knows to be false in a material respect, or

(b)recklessly to make a statement which is false in a material respect.

145Information orders

(1)This section applies if, on an application by the Commissioner, a court is satisfied that a person has failed to comply with a requirement of an information notice.

(2)The court may make an order requiring the person to provide to the Commissioner some or all of the following—

(a)information referred to in the information notice;

(b)other information which the court is satisfied the Commissioner requires, having regard to the statement included in the notice in accordance with section 142(2)(b).

(3)The order—

(a)may specify the form in which the information must be provided,

(b)must specify the time at which, or the period within which, the information must be provided, and

(c)may specify the place where the information must be provided.