Data Protection Act 1984

Supervision

10 Enforcement notices

(1) If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may serve him with a notice (" an enforcement notice ") requiring him to take, within such time as is specified in the notice, such steps as are so specified for complying with the principle or principles in question.

(2) In deciding whether to serve an enforcement notice the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress.

(3) An enforcement notice in respect of a contravention of the fifth data protection principle may require the data user—

(a) to rectify or erase the data and any other data held by him and containing an expression of opinion which appears to the Registrar to be based on the inaccurate data; or

(b) in the case of such data as are mentioned in subsection (2) of section 22 below, either to take the steps mentioned in paragraph (a) above or to take such steps as are specified in the notice for securing compliance with the requirements specified in that subsection and, if the Registrar thinks fit, for supplementing the data with such statement of the true facts relating to the matters dealt with by the data as the Registrar may approve.

(4) The Registrar shall not serve an enforcement notice requiring the person served with the notice to take steps for complying with paragraph (a) of the seventh data protection principle in respect of any data subject unless satisfied that the person has contravened section 21 below by failing to supply information to which the data subject is entitled and which has been duly requested in accordance with that section.

(5) An enforcement notice shall contain—

(a) a statement of the principle or principles which the Registrar is satisfied have been or are being contravened and his reasons for reaching that conclusion; and

(b) particulars of the rights of appeal conferred by section 13 below.

(6) Subject to subsection (7) below, the time specified in an enforcement notice for taking the steps which it requires shall not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, those steps need not be taken pending the determination or withdrawal of the appeal.

(7) If by reason of special circumstances the Registrar considers that the steps required by an enforcement notice should be taken as a matter of urgency he may include a statement to that effect in the notice; and in that event subsection (6) above shall not apply but the notice shall not require the steps to be taken before the end of the period of seven days beginning with the date on which the notice is served.

(8) The Registrar may cancel an enforcement notice by written notification to the person on whom it was served.

(9) Any person who fails to comply with an enforcement notice shall be guilty of an offence; but it shall be a defence for a person charged with an offence under this subsection to prove that he exercised all due diligence to comply with the notice in question.

11 De-registration notices

(1) If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may—

(a) serve him with a notice (" a de-registration notice ") stating that he proposes, at the expiration of such period as is specified in the notice, to remove from the register all or any of the particulars constituting the entry or any of the entries contained in the register in respect of that person ; and

(b) subject to the provisions of this section, remove those particulars from the register at the expiration of that period.

(2) In deciding whether to serve a de-registration notice the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress, and the Registrar shall not serve such a notice unless he is satisfied that compliance with the principle or principles in question cannot be adequately secured by the service of an enforcement notice.

(3) A de-registration notice shall contain—

(a) a statement of the principle or principles which the Registrar is satisfied have been or are being contravened and his reasons for reaching that conclusion and deciding that compliance cannot be adequately secured by the service of an enforcement notice; and

(b) particulars of the rights of appeal conferred by section 13 below.

(4) Subject to subsection (5) below, the period specified hi a de-registration notice pursuant to subsection (1)(a) above shall not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the particulars shall not be removed pending the determination or withdrawal of the appeal.

(5) If by reason of special circumstances the Registrar considers that any particulars should be removed from the register as a matter of urgency he may include a statement to that effect in the de-registration notice; and in that event subsection (4) above shall not apply but the particulars shall not be removed before the end of the period of seven days beginning with the date on which the notice is served.

(6) The Registrar may cancel a de-registration notice by written notification to the person on whom it was served.

(7) References in this section to removing any particulars include references to restricting any description which forms part of any particulars.

12 Transfer prohibition notices

(1) If it appears to the Registrar that—

(a) a person registered as a data user or as a data user who also carries on a computer bureau ; or

(b) a person treated as so registered by virtue of section 7(6) above,

proposes to transfer personal data held by him to a place outside the United Kingdom, the Registrar may, if satisfied as to the matters mentioned in subsection (2) or (3) below, serve that person with a notice (" a transfer prohibition notice ") prohibiting him from transferring the data either absolutely or until he has taken such steps as are specified in the notice for protecting the interests of the data subjects in question.

(2) Where the place to which the data are to be transferred is not in a State bound by the European Convention the Registrar must be satisfied that the transfer is likely to contravene, or lead to a contravention of, any of the data protection principles.

(3) Where the place to which the data are to be transferred is in a State bound by the European Convention the Registrar must be satisfied either—

(a) that—

(i) the person in question intends to give instructions for the further transfer of the data to a place which is not in such a State ; and

(ii) that the further transfer is likely to contravene, or lead to a contravention of, any of the data protection principles; or

(b) in the case of data to which an order under section 2(3) above applies, that the transfer is likely to contravene or lead to a contravention of, any of the data protection principles as they have effect in relation to such data.

(4) In deciding whether to serve a transfer prohibition notice the Registrar shall consider whether the notice is required for preventing damage or distress to any person and shall have regard to the general desirability of facilitating the free transfer of data between the United Kingdom and other states and territories.

(5) A transfer prohibition notice shall specify the time when it is to take effect and contain—

(a) a statement of the principle or principles which the Registrar is satisfied are likely to be contravened and his reasons for reaching that conclusion ; and

(b) particulars of the rights of appeal conferred by section 13 below.

(6) Subject to subsection (7) below, the time specified in a transfer prohibition notice pursuant to subsection (5) above shall not be before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice shall not take effect pending the determination or withdrawal of the appeal.

(7) If by reason of special circumstances the Registrar considers that the prohibition should take effect as a matter of urgency he may include a statement to that effect in the transfer prohibition notice; and in that event subsection (6) above shall not apply but the notice shall not take effect before the end of the period of seven days beginning with the date on which the notice is served.

(8) The Registrar may cancel a transfer prohibition notice by written notification to the person on whom it was served.

(9) No transfer prohibition notice shall prohibit the transfer of any data where the transfer of the information constituting the data is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the United Kingdom.

(10) Any person who contravenes a transfer prohibition notice shall be guilty of an offence; but it shall be a defence for a person charged with an offence under this subsection to prove that he exercised all due diligence to avoid a contravention of the notice in question.

(11) For the purposes of this section a place shall be treated as in a State bound by the European Convention if it is in any territory in respect of which the State is bound.