Enforcement notice

76.(1) Where the Commissioner is satisfied that a data controller or a data processor has contravened or is contravening this Act, the Commissioner may serve him with a notice, to be referred to as an “enforcement notice” requiring him, to do either or both of the following:

(a) to take within such time as may be specified in the notice, or to refrain from taking after such time as may be so specified, such steps as are so specified; or

(b) to refrain from processing any personal data, or any personal data of a description specified in the notice, or to refrain from processing the personal data for a purpose so specified or in a manner so specified, after such time as may be so specified.

(2) In deciding whether to serve an enforcement notice, the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress.

(3) An enforcement notice shall contain

(a) a statement of the provision of the Act which the Commissioner is satisfied have been or are being contravened and his reasons for reaching that conclusion; and

(b) particulars of the right of appeal conferred by section 91.

(4) Subject to subsections (5) and (6), an enforcement notice shall not require any of the provisions of the notice to be complied with before the end of the period within which an appeal can be brought against the notice and, where such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.

(5) Where by reason of special circumstances the Commissioner considers that an enforcement notice should be complied with as a matter of urgency he may include in the notice a statement to that effect and a statement of his reasons for reaching that conclusion.

(6) Where subsection (5) applies, the notice shall not require the provisions of the notice to be complied with before the end of the period of 7 days beginning with the day on which the notice is served.