The eagerly awaited Data Protection Bill 2018 (Bill) was published on 1 February 2018. The Bill implements those instances where Member States are permitted some flexibility under the General Data Protection Regulation (GDPR) and contains many important provisions on the robust enforcement powers of the reformed Data Protection Commission. We examine the key enforcement provisions in the Bill.
The Commission - Scope and Powers
The Bill establishes a new supervisory authority, the Data Protection Commission, the "Commission", which will replace the existing Data Protection Commissioner. The capacity of the Commission will be greatly increased with the possibility of appointing up to three Commissioners, one of whom will be the Chairperson.
Where the Commission decides to launch an inquiry as a result of a complaint or of its own volition, it will have a wide range of powers. These cover issuing warnings and reprimands right up to imposing a temporary or permanent ban on processing activities by a controller or processor.
On receipt of a complaint, the Commission may take a number of direct actions against a processor or a controller without conducting an "inquiry", including issuing an enforcement notice to make good a data subject's rights. There is, it seems, no requirement for the Commission to identify whether a complaint is vexatious or frivolous before rejecting it, which is required under current law.
The Bill empowers the Commission to provide a complainant with "advice" in respect to his/her complaint. This is a new power; however, it remains unclear whether it would extend to providing a complainant with advice on the pursuit of civil remedies against a controller/processor.
Powers of investigation
Similar to current law, the Bill contains provisions on issuing information and enforcement notices. However, the Bill's provisions are more detailed and onerous. Interestingly, the power to serve an enforcement notice or an information notice lies with the Commission or an authorised officer. The granting of such powers to an authorised officer is certainly a new development and a departure from current law.
The Bill provides that authorised officers will have powers to obtain and seek access to documents and will have the power to oblige a person to answer questions under oath. Their powers of entry will not be automatic and, failing obtaining consent from the owner of the premises, a district court warrant is needed...