The Data Protection (Monetary Penalties) Order 2010

Statutory Instruments

2010 No. 910

Data Protection

The Data Protection (Monetary Penalties) Order 2010

Made

22nd March 2010

Coming into force

6th April 2010

The Secretary of State has consulted the Information Commissioner in accordance with section 67(3) of the Data Protection Act 1998(1).

In accordance with section 67(4) of that Act, a draft of this instrument was laid before Parliament and approved by a resolution of each House of Parliament.

Accordingly the Secretary of State, in exercise of the powers conferred by section 55E(2) of that Act, makes the following Order:

Citation, commencement and interpretation

1.—(1) This Order may be cited as the Data Protection (Monetary Penalties) Order 2010 and comes into force on 6th April 2010.

(2) In this Order references to sections and Schedules are references to sections of and Schedules to the Data Protection Act 1998.

Monetary penalty notices: procedure: written representations

2.  The Commissioner must consider any written representations made in relation to a notice of intent when deciding whether to serve a monetary penalty notice.

Monetary penalty notices: procedure: supplementary provisions

3.—(1) The period specified by the Commissioner for making written representations in accordance with section 55B(3)(a) must not be less than 21 days beginning with the first day after the date of service of the notice of intent.

(2) The Commissioner may not serve a monetary penalty notice relating to a notice of intent if a period of 6 months has elapsed beginning with the first day after the service of the notice of intent.

(3) The period specified in accordance with section 55A(6) must be at least 28 days beginning with the first day after the date of service of the monetary penalty notice.

Monetary penalty notices: variation

4.—(1) The Commissioner may vary a monetary penalty notice by written notice to the person on whom it was served.

(2) A notice under paragraph (1) must specify—

(a) the notice concerned; and

(b) how the notice is varied.

(3) The Commissioner may not vary a monetary penalty notice so as to reduce the period specified in accordance with section 55A(6).

(4) The Commissioner may not vary a monetary penalty notice so as to increase the amount of the monetary penalty, or otherwise vary a monetary penalty notice to the detriment of the person on whom it was served.

(5) A person on whom a notice under paragraph (1) is served may appeal to the Tribunal against that notice.

(6) Where the Commissioner varies a monetary penalty notice so as to reduce the amount of the monetary penalty, the Commissioner must repay any amount that has already been paid that exceeds the amount of the reduced monetary penalty.

Monetary penalty notices: cancellation

5.—(1) The Commissioner may cancel a monetary penalty notice by written notice to the person on whom it was served.

(2) Where a monetary penalty notice has been cancelled, the Commissioner may not take any further action under section 55A, 55B or 55D in relation to the contravention to which that monetary penalty notice relates.

(3) Where a monetary penalty notice has been cancelled, the Commissioner must repay any amount that has been paid pursuant to that notice.

Monetary penalty notices: enforcement

6.  The Commissioner must not take action to enforce a monetary penalty unless—

(a) the period specified in accordance with section 55A(6) has expired and all or any of the monetary penalty has not been paid;

(b) all relevant appeals against the monetary penalty notice and any variation of it have been either been decided or withdrawn; and

(c) the period for the data controller to appeal against the monetary penalty and any variation of it has expired.

Appeals

7.  Section 49 and Schedule 6 have effect in relation to appeals under section 55B(5) and article 4(5) as they have effect in relation to appeals under section 48(1).

Michael Wills

Minister of State

Ministry of Justice

22nd March 2010

EXPLANATORY NOTE

(This note is not part of the Order)

This Order makes further provision in relation to monetary penalty notices and notices of intent served under section 55A and section 55B of the Data Protection Act 1998.

Article 2 requires the Information Commissioner to consider any written representations made by a data controller in relation to a notice of intent, when deciding whether or not to serve a monetary penalty notice.

Article 3 sets out the minimum period the Information Commissioner may set for a data controller to make written representations about a notice of intent (21 days), and the minimum period after service of the monetary penalty notice within which the penalty must be paid (28 days). It also provides that the Information Commissioner may not serve a monetary penalty notice more than six months after the service of a notice of intent.

Article 4 gives the Information Commissioner power to vary monetary penalty notices.

Article 5 gives the Information Commissioner power to cancel monetary penalty notices.

Article 6 provides for the conditions that must be met before the Information Commissioner can enforce a monetary penalty notice.

Article 7 makes provision about appeals against monetary penalty notices and variation notices.

The full Impact Assessment is available at http://www.justice.gov.uk/consultations/docs/ia-monetary-penalties-stat-inst.pdf and is also annexed to the Explanatory Memorandum which is available alongside the instrument on the OPSI website.

(1)

1998 c. 29.

(2)

Section 55E was inserted into the Data Protection Act 1998 by section 144 of the Criminal Justice and Immigration Act 2008 (c.4).