Data Protection Act 2018

Section 17

SCHEDULE 5 U.K. Accreditation of certification providers: reviews and appeals

Introduction U.K.

1 (1) This Schedule applies where— U.K.

(a) a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and

(b) is dissatisfied with the decision on that application.

(2) In this Schedule—

• “accreditation authority” means—

  (a)

  the Commissioner, or

  (b)

  the [F1 UK national accreditation body];

• “certification provider” and “[F1 UK national accreditation body]” have the same meaning as in section 17.

Textual Amendments

F1 Words in Sch. 5 para. 1(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 95(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Review U.K.

2 (1) The applicant may ask the accreditation authority to review the decision. U.K.

(2) The request must be made in writing before the end of the period of 28 days beginning with the day on which the person receives written notice of the accreditation authority's decision.

(3) The request must specify—

(a) the decision to be reviewed, and

(b) the reasons for asking for the review.

(4) The request may be accompanied by additional documents which the applicant wants the accreditation authority to take into account for the purposes of the review.

(5) If the applicant makes a request in accordance with sub-paragraphs (1) to (4), the accreditation authority must—

(a) review the decision, and

(b) inform the applicant of the outcome of the review in writing before the end of the period of 28 days beginning with the day on which the request for a review is received.

Right to appeal U.K.

3 (1) If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision to an appeal panel constituted in accordance with paragraph 4. U.K.

(2) The request must be made in writing before the end of the period of 3 months beginning with the day on which the person receives written notice of the decision on the review.

(3) A request must specify—

(a) the decision to be referred to the appeal panel, and

(b) the reasons for asking for it to be referred.

(4) The request may be accompanied by additional documents which the applicant wants the appeal panel to take into account.

(5) The applicant may discontinue an appeal at any time by giving notice in writing to the accreditation authority.

Appeal panel U.K.

4 (1) If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph. U.K.

(2) An appeal panel must consist of a chair and at least two other members.

(3) Where the request relates to a decision of the Commissioner—

(a) the Secretary of State may appoint one person to be a member of the appeal panel other than the chair, and

(b) subject to paragraph (a), the Commissioner must appoint the members of the appeal panel.

(4) Where the request relates to a decision of the [F2 UK national accreditation body]—

(a) the Secretary of State—

(i) may appoint one person to be a member of the appeal panel other than the chair, or

(ii) may direct the Commissioner to appoint one person to be a member of the appeal panel other than the chair, and

(b) subject to paragraph (a), the chair of the [F2 UK national accreditation body] must appoint the members of the appeal panel.

(5) A person may not be a member of an appeal panel if the person—

(a) has a commercial interest in the decision referred to the panel,

(b) has had any prior involvement in any matters relating to the decision, or

(c) is an employee or officer of the accreditation authority.

(6) The Commissioner may not be a member of an appeal panel to which a decision of the Commissioner is referred.

(7) The applicant may object to all or any of the members of the appeal panel appointed under sub-paragraph (3) or (4).

(8) If the applicant objects to a member of the appeal panel under sub-paragraph (7), the person who appointed that member must appoint a replacement.

(9) The applicant may not object to a member of the appeal panel appointed under sub-paragraph (8).

Textual Amendments

F2 Words in Sch. 5 para. 4(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 95(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Hearing U.K.

5 (1) If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented. U.K.

(2) Any additional documents which the applicant or the accreditation authority want the appeal panel to take into account must be submitted to the chair of the appeal panel at least 5 working days before the hearing.

(3) The appeal panel may allow experts and witnesses to give evidence at a hearing.

Decision following referral to appeal panel U.K.

6 (1) The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph 4— U.K.

(a) make a reasoned recommendation in writing to the accreditation authority, and

(b) give a copy of the recommendation to the applicant.

(2) For the purposes of sub-paragraph (1), where there is an objection under paragraph 4(7), an appeal panel is not to be taken to be established in accordance with paragraph 4 until the replacement member is appointed (or, if there is more than one objection, until the last replacement member is appointed).

(3) The accreditation authority must, before the end of the period of 3 working days beginning with the day on which the authority receives the recommendation—

(a) make a reasoned final decision in writing, and

(b) give a copy of the decision to the applicant.

(4) Where the accreditation authority is the [F3 UK national accreditation body], the recommendation must be given to, and the final decision must be made by, the chief executive of that body.

Textual Amendments

F3 Words in Sch. 5 para. 6(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 95(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Meaning of “working day” U.K.

7 U.K. In this Schedule, “working day” means any day other than—

(a) Saturday or Sunday,

(b) Christmas Day or Good Friday, or

(c) a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom.