Data Protection Act 2018

Guidance

160 Guidance about regulatory action

(1) The Commissioner must produce and publish guidance about how the Commissioner proposes to exercise the Commissioner’s functions in connection with—

(a) information notices,

(b) assessment notices,

(c) enforcement notices, and

(d) penalty notices.

(2) The Commissioner may produce and publish guidance about how the Commissioner proposes to exercise the Commissioner’s other functions under this Part.

(3) In relation to information notices, the guidance must include—

(a) provision specifying factors to be considered in determining the time at which, or the period within which, information is to be required to be provided;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an information notice to a person in reliance on section 142(7) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an information notice.

(4) In relation to assessment notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an assessment notice to a person;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases);

(c) provision specifying descriptions of documents or information that—

(i) are not to be examined or inspected in accordance with an assessment notice, or

(ii) are to be so examined or inspected only by a person of a description specified in the guidance;

(d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice;

(e) provision about the nature of interviews carried out in accordance with an assessment notice;

(f) provision about the preparation, issuing and publication by the Commissioner of assessment reports in respect of controllers and processors that have been given assessment notices;

(g) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice.

(5) The guidance produced in accordance with subsection (4)(c) must include provisions that relate to—

(a) documents and information concerning an individual’s physical or mental health;

(b) documents and information concerning the provision of social care for an individual.

(6) In relation to enforcement notices, the guidance must include—

(a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases);

(c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.

(7) In relation to penalty notices, the guidance must include—

(a) provision about the circumstances in which the Commissioner would consider it appropriate to issue a penalty notice;

(b) provision about the circumstances in which the Commissioner would consider it appropriate to allow a person to make oral representations about the Commissioner’s intention to give the person a penalty notice;

(c) provision explaining how the Commissioner will determine the amount of penalties;

(d) provision about how the Commissioner will determine how to proceed if a person does not comply with a penalty notice.

(8) The Commissioner—

(a) may alter or replace guidance produced under this section, and

(b) must publish any altered or replacement guidance.

(9) Before producing guidance under this section (including any altered or replacement guidance), the Commissioner must consult—

(a) the Secretary of State, and

(b) such other persons as the Commissioner considers appropriate.

(10) Section 161 applies in relation to the first guidance under subsection (1).

(11) The Commissioner must arrange for other guidance under this section (including any altered or replacement guidance) to be laid before Parliament.

(12) In this section, “social care” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).

161 Approval of first guidance about regulatory action

(1) When the first guidance is produced under section 160(1)—

(a) the Commissioner must submit the final version to the Secretary of State, and

(b) the Secretary of State must lay the guidance before Parliament.

(2) If, within the 40-day period, either House of Parliament resolves not to approve the guidance—

(a) the Commissioner must not issue the guidance, and

(b) the Commissioner must produce another version of the guidance (and this section applies to that version).

(3) If, within the 40-day period, no such resolution is made—

(a) the Commissioner must issue the guidance, and

(b) the guidance comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(4) Nothing in subsection (2)(a) prevents another version of the guidance being laid before Parliament.

(5) In this section, “the 40-day period” means—

(a) if the guidance is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

(b) if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

(6) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.