Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 5Data protection and privacy

Chapter 2Privacy and electronic communications

115Commissioner’s enforcement powers

(1)

The PEC Regulations are amended in accordance with subsections (2) to (8).

(2)

In regulation 5 (security of public electronic communications services), omit paragraph (6).

(3)

Omit regulation 5B (personal data breach: audit).

(4)

In regulation 5C (personal data breach: fixed monetary penalty)—

(a)

in paragraph (10)—

(i)

omit “and Northern Ireland”, and

(ii)

in paragraph (a), for “a county court” substitute “the county court”, and

(b)

after paragraph (11) insert—

“(12)

In Northern Ireland, the penalty is recoverable—

(a)

if a county court so orders, as if it were payable under an order of that court;

(b)

if the High Court so orders, as if it were payable under an order of that court.

(13)

The Secretary of State may by regulations made by statutory instrument amend this regulation so as to substitute a different amount for the amount for the time being specified in paragraph (2) or (5).

(14)

Regulations under paragraph (13) may make transitional provision.

(15)

Before making regulations under paragraph (13), the Secretary of State must consult—

(a)

the Information Commissioner, and

(b)

such other persons as the Secretary of State considers appropriate.

(16)

A statutory instrument containing regulations under this regulation may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.”

(5)

For regulation 31 substitute—

“Information Commissioner’s enforcement powers31.

(1)

Schedule 1 provides for certain provisions of Parts 5 to 7 of the Data Protection Act 2018 to apply with modifications for the purposes of enforcing these Regulations.

(2)

In regulations 32 and 33, “enforcement functions” means the functions of the Information Commissioner under those provisions, as applied by that Schedule.”

(6)

Omit regulation 31A (third party information notices).

(7)

Omit regulation 31B (appeals against third party information notices).

(8)

For Schedule 1 substitute the Schedule set out in Schedule 13 to this Act.

(9)

In paragraph 58(1) of Schedule 20 to the Data Protection Act 2018 (transitional provision relating to the PEC Regulations) for “regulations 2, 31 and 31B of, and Schedule 1 to,” substitute “regulation 2 of”.

(10)

A requirement to consult under regulation 5C(15) of the PEC Regulations (inserted by subsection (4)(b) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.