PART 6

Enforcement

Penalties

Penalty notices: restrictions
156
1
The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—
a
a determination under section 174 with respect to the data or the processing has taken effect, and
b
a court has granted leave for the notice to be given.
2
A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—
a
the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and
b
the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.
3
The Commissioner may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.
4
The Commissioner may not give a penalty notice to—
a
the Crown Estate Commissioners, or
b
a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).
5
In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.
Pt. 6 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))
S. 156 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)