Part 5Data protection and privacy

Chapter 1Data protection

Enforcement

101Penalty notices

(1)

The 2018 Act is amended as follows.

(2)

In paragraph 2 of Schedule 16 (notice of intent to impose penalty), omit sub-paragraphs (2) and (3).

(3)

In paragraph 4 of that Schedule (giving a penalty notice)—

(a)

before sub-paragraph (1) insert—

“A1

This paragraph applies where the Commissioner gives a notice of intent to a person.

A2

Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—

(a)

a penalty notice, or

(b)

written notice that the Commissioner has decided not to give a penalty notice to the person.”,

(b)

in sub-paragraph (1)—

(i)

at the beginning, insert “But”, and

(ii)

after “penalty notice” insert “to the person”, and

(c)

in sub-paragraph (2), for “a person” substitute “the person”.

(4)

In section 160 (guidance about regulatory action), in subsection (7), after paragraph (d) insert—

“(e)

provision about the circumstances in which the Commissioner would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.”