Section 156 — Data Protection Act 2018: Penalty notices: restrictions

Penalty notices: restrictions 156 1 The Commissioner may not give a controller or processor a penalty notice in reliance on section 149(2) with respect to the processing of personal data for the special purposes unless—

a a determination under section 174 with respect to the data or the processing has taken effect, and b a court has granted leave for the notice to be given.

2 A court must not grant leave for the purposes of subsection (1)(b) unless it is satisfied that—

a the Commissioner has reason to suspect a failure described in section 149(2) which is of substantial public importance, and b the controller or processor has been given notice of the application for leave in accordance with rules of court or the case is urgent.

3 The Commissioner may not give a controller or processor a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either House of Parliament.

4 The Commissioner may not give a penalty notice to—

a the Crown Estate Commissioners, or b a person who is a controller by virtue of section 209(4) (controller for the Royal Household etc).

5 In the case of a joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities for compliance with that Part are determined in an arrangement under section 58 or 104, the Commissioner may only give the controller a penalty notice in reliance on section 149(2) if the controller is responsible for compliance with the provision, requirement or principle in question.