Section 161A | Annual report on regulatory action ^F1

From legislation.gov.uk

(1)The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5).^F1

(2)The report must include the following information about UK GDPR investigations—^F1

(a)the number of investigations begun, continued or completed by the Commissioner during the reporting period,^F1

(b)the different types of act and omission that were the subject matter of the investigations,^F1

(c)the enforcement powers exercised by the Commissioner in the reporting period in connection with the investigations,^F1

(d)the duration of investigations that ended in the reporting period, and^F1

(e)the different types of outcome in investigations that ended in that period.^F1

(3)The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with—^F1

(a)processing of personal data by a competent authority for any of the law enforcement purposes, and^F1

(b)processing of personal data to which applies.^F1

(4)The information included in the report in accordance with subsections (2) and (3) must include information about—^F1

(a)the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and^F1

(b)the reasons why that happened.^F1

(5)The report must include a review of how the Commissioner had regard to the guidance published under when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3).^F1

(6)In this section—^F1

“enforcement powers” means the powers under—

Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,

sections to of this Act,

paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and

Schedules and to this Act;

“the law enforcement purposes” has the meaning given in of this Act;

“the reporting period” means the period to which the report relates;

“UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).