INFORMATION NOTICES
Part V of the DPA is titled ‘Enforcement’ and it describes a number of very important powers that vest in the Information Commissioner. In the widest sense of the word all enforcement powers aid transparency, but in this section it is only the Information Commissioner’s power to serve information notices and special information notices that are considered, as they have the closest direct link with transparency.
The essence of both kinds of information notice is that they require the data controller to supply the Information Commissioner with information to enable the Information Commissioner to properly discharge their statutory functions. This immediately demonstrates the importance of information notices within the legal regime and data controllers will not be surprised to learn that the failure to comply with an information notice is a criminal offence. If the data controller believes that the notice should not have been served, or if it objects to providing some of the information sought, it must appeal to the Information Tribunal.
Information notices
Section 43 of the DPA empowers the Information Commissioner to serve an information notice on a data controller in two circumstances. The first is where the Information Commissioner has received a request for an assessment under section 42 of the DPA. The second is where the Information Commissioner reasonably requires any information ‘for the purpose of determining whether the data controller has complied or is complying with the data protection principles’.
The information notice will require the data controller to supply the Information Commissioner with the information specified in the notice in the form specified, within the time specified. The notice may ask the data controller to provide specific information about how it has complied with the data protection principles.
The notice must identify whether the Information Commissioner has received a request for an assessment or whether the Information Commissioner regards the specified information as being relevant for the purpose of their determination of whether the data controller has complied, or is complying, with the data protection principles. If the latter case applies, the Information Commissioner must also state their reasons for regarding the information as being relevant to the determination of the question of compliance with the principles. Finally, the information notice must specify the data controller’s rights of appeal.
Requests for assessments
Section 42 of the DPA provides that a person who believes that they have been directly affected by the processing of any personal data may make a request to the Information Commissioner for an assessment as to whether it is likely or unlikely that the processing has been carried out in accordance with the DPA.
The Information Commissioner has discretion as to the manner of their assessment, but it would seem to be the case that they can only to refuse to carry out an assessment if they consider that they do not have enough information to enable them to be satisfied of the identity of the person making the request and to enable them to identify the processing in question. The Information Commissioner may ask the applicant to supply them with additional information to prove the applicant’s identity and the identity of the processing in question (section 42(2)).
Section 42(3) identifies factors that the Information Commissioner may have regard to in determining the manner of his assessment. These include:
the extent to which the request raises a matter of substance;
any undue delay in making the request;
whether the applicant could make an access request under section 7.
Special information notices
Section 44 of the DPA says that the Information Commissioner may serve a special information notice in two circumstances. The first is where a request for an assessment has been received under section 42 of the DPA. The second is much more complicated, applying where court proceedings have been stayed under section 32 of the DPA.
Section 32(4) of the DPA says that the court may stay legal proceedings brought under sections 7(9), 10(4), 12(8) or 14 of the DPA where it appears to the court that any personal data to which the proceedings relate are being processed only for the special purposes and with a view to the publication by any person of any previously unpublished journalistic, literary or artistic material. In such a case the proceedings will remain stayed until they are either withdrawn or until the Information Commissioner makes a determination under section 45 of the DPA. Section 45 gives the Information Commissioner the power to ‘determine’ that personal data are not being processed for the special purposes or are not being processed with a view to the publication.
Where proceedings have been stayed under section 32, the Information Commissioner may serve a special information notice on the data controller, but only where they have reasonable grounds for suspecting that personal data to which the proceedings relate are not being processed only for the special purposes or are not being processed with a view to the publication by any person of any previously unpublished journalistic, literary or artistic material.
Thus, the purpose of special information notices is twofold:
to ascertain whether personal data are being processed only for the special purposes;
to ascertain whether the personal data are being processed with a view to the publication by any person of any previously unpublished journalistic, literary or artistic material.
If the special information notice is served as a result of a request for an assessment, the notice must state this fact. If it is served because the Information Commissioner suspects that the personal data are not being processed only for the special purposes or are not being processed with a view to the publication by any person of any previously unpublished journalistic, literary or artistic material, it must state this fact and state the Information Commissioner’s grounds for their suspicion. As with information notices, the right of appeal must be stated.
Time for compliance
The service of information notices and special information notices can both be appealed by the data controller. In order to cater for the making of an appeal, the DPA says that the time for providing the information sought shall not expire before the end of the period in which an appeal can be brought (section 43(3) and section 44(5)).
The time for bringing an appeal is specified in Rules made under the DPA92 and is currently 28 days calculated from the date on which the notice was served on, or given to, the data controller. If an appeal is brought within time, the information does not need to be supplied pending the determination of the appeal, or its withdrawal.
This rule is subject to an important exception, however. In cases where the Information Commissioner considers that the information is required as a matter of urgency they may require its supply before the expiry of the time for appealing, although this is subject to a minimum time for compliance of seven days. This commences with the day on which the notice is served. If the Information Commissioner wishes to rely upon this exception, they must state the reasons for their conclusion that the information is required as a matter of urgency.
Legal professional privilege and the privilege from self-incrimination
The data controller is not required to supply the information if it is protected by legal professional privilege or the privilege against self-incrimination.
Appeals and offences
These matters are discussed in Chapter 7.