The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

Regulation 3(3)

SCHEDULE 2 U.K. Enforcement powers of the Information Commissioner under the 1998 Act

Enforcement powers U.K.

1.  For the purposes of enforcing these Regulations and the eIDAS Regulation, the following sections of the 1998 Act M1 apply subject to the modifications in paragraph 2—

(a) section 40 (enforcement notices);

(b) section 41 (cancellation of enforcement notice);

(c) section 41A M2 (assessment notices);

(d) section 41B M3 (assessment notices: limitations);

(e) section 41C M4 (code of practice about assessment notices);

(f) section 43 M5 (information notices);

(g) section 47 (failure to comply with notice);

(h) section 48 M6 (rights of appeal);

(i) section 49 M7 (determination of appeals);

(j) section 60 M8 (prosecutions and penalties);

(k) Schedule 6 M9 ;

(l) Schedule 9 M10 .

Marginal Citations

M1 1998 c.29.

M2 Section 41A was inserted by the Coroners and Justice Act 2009 (c.25), section 173.

M3 Section 41B was inserted by the Coroners and Justice Act 2009 (c.25), section 173.

M4 Section 41C was inserted by the Coroners and Justice Act 2009 (c.25), section 173 and amended by the Protection of Freedoms Act 2012 (c.9), section 106(1).

M5 Section 43 was amended by the Coroners and Justice Act 2009 (c.25), Schedule 20, paragraphs 8(2), 8(3), 8(4) and 10(2) and 10(3).

M6 Section 48 was amended by the Coroners and Justice Act 2009 (c.25), Schedule 20, paragraphs (3)(a) and (b) and 5(2).

M7 Section 49 was amended by S.I. 2010/22.

M8 Section 60 was amended by the Crime (International Co-operation) Act 2003 (c.32), Schedule 5, paragraph 70.

M9 Schedule 6 was amended by S.I. 2010/22.

M10 Schedule 9 was amended by the Coroners and Justice Act 2009 (c.25), Schedule 20, paragraphs 14(2), 14(3)(a) and (b), 14(4), 14(5), 14(6) and 14(7), Schedule 22, paragraph 46 and Schedule 23, paragraph 1.

2.—(1) The sections referred to in paragraph 1 are to apply as if— U.K.

(a) for “data controller”, on each occasion that it appears, there were substituted “ trust service provider ”;

(b) for “data protection principles” or “data protection principle or principles”, on each occasion they appear, there were substituted “ requirements of Chapter III of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market (in this Part referred to as “the relevant requirements”) ”; and

(c) for “principle or principles”, on each occasion that it appears, (otherwise than as set out in paragraph (b)), there were substituted “ requirements ”.

(2) Section 40 is to apply as if—

(a) in subsection (2), the words “or distress” were omitted;

(b) in subsection (6)(a), for “his” there were substituted “the Commissioner's”;

(c) in subsection (8), for “he” there were substituted “ the Commissioner ”;

(d) subsections (3), (4), (5), (9) and (10) were omitted.

(3) Section 41(1) is to apply as if for “he” there were substituted “ the Commissioner ”.

(4) Section 41A is to apply as if—

(a) in subsection (1) the words “within subsection (2)” were omitted;

(b) subsections (2), (8), (9), (10), (11) and (12) were omitted; and

(c) subsections (3)(g) and (h) were omitted.

(5) Section 41B is to apply as if in subsections 3(a) and 3(b), for “this Act”, there were substituted “ Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market ”.

(6) Section 41C is to apply as if subsection (7) were omitted.

(7) Section 43 is to apply as if—

(a) for subsections (1) and (2) there were substituted—

“(1) If the Commissioner reasonably requires any information for the purpose of determining whether a trust service provider has complied or is complying with the relevant requirements, it may serve the trust service provider with a notice (in this Act referred to as “an information notice”).

(2) An information notice must require the trust service provider, within such time as is specified in the notice, to furnish the Commissioner, in such form as may be so specified, with such information relating to compliance with the relevant requirements as is so specified.

(3) An information notice must contain a statement that the Commissioner regards the specified information as relevant for the purpose of determining whether the trust service provider has complied or is complying with the relevant requirements and the Commissioner's reason for regarding it as relevant for that purpose.”;

(b) in subsection (1A), for “in subsection (1)” there were substituted “ in subsection (3) ”;

(c) in subsection (5), for “he” there were substituted “ the Commissioner ”;

(d) in subsection (6) for “this Act” there were substituted “ Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market ”;

(e) in subsections (8) and (8B) for “this Act”, on each occasion that it appears, there were substituted “ this Act as applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 ”; and

(f) subsection (10) were omitted.

(8) Section 47 is to apply as if—

(a) in subsection (1), for “, an information notice or special information notice”, there were substituted “ or an information notice ”;

(b) in subsection (2) the words “or a special information notice” were omitted; and

(c) after subsection (3) there were inserted—

“(4) The Commissioner may serve a trust service provider with a withdrawal notice if the Commissioner—

(a) has served a qualified trust service provider with an enforcement notice or an information notice;

(b) the qualified trust service provider has failed to comply with such notice within the period specified; and

(c) there is no pending appeal against such notice.

(5) In subsection (4), “withdrawal notice” means a notice withdrawing the qualified status from a trust service provider or the qualified status of a service provided by the trust service provider.”.

(9) Section 48 is to apply as if—

(a) in subsection (1), for “special information”, there were substituted “ withdrawal ”;

(b) in subsection (3)—

(i) for “, an information notice or special information notice” there were substituted “ or an information notice ”; and

(ii) the words “or 44(6)” were omitted;

(c) subsection (4) were omitted.

(10) Section 49 is to apply as if subsection (5) were omitted.

(11) Section 60 is to apply as if—

(a) for “this Act”, on each occasion that it appears, there were substituted “ this Act, as applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 ”;

(b) in subsection (2), the words “section 54A and” were omitted;

(c) in subsection (3), the words “section 54A and” were omitted; and

(d) in subsection (4), subsections (a) and (b) were omitted.

(12) Schedule 6, paragraph 7, is to apply as if—

(a) for sub-paragraph (1), there were substituted “ Tribunal Procedural Rules may make provision for regulating the exercise of the rights of appeal conferred by section 48 of this Act ”; and

(b) in sub-paragraph (2) the words “and the Freedom of Information Act 2000” were omitted.

(13) Schedule 9 is to apply as if—

(a) in paragraph 1—

(i) for sub-paragraph (1)(a) there were substituted—

“(a) that a trust service provider has contravened or is contravening any of the requirements of Chapter III of Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market (in this Schedule referred to as “the relevant requirements”), or”;

(ii) in sub-paragraph (1)(b)—

(aa) for “this Act” there were substituted “ this Act as applied by the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 ”;

(bb) the words “subject to sub-paragraph (2) and paragraph 2” were omitted;

(iii) in sub-paragraph (1B), the words “; but this is subject to sub-paragraph (2) and paragraph 2” were omitted;

(iv) sub-paragraph (2) were omitted;

(v) in sub-paragraph (3)(c) the words “which is used or intended to be used for the processing of personal data” were omitted;

(b) paragraph 8 were omitted; and

(c) in paragraph 9, for “this Act”, on each occasion that it appears, there were substituted “ Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic transactions in the internal market ”.