Please also indicate what categories of data controllers, if any, you would expect to be exempt from such a requirement.
Q5.6.4. To what extent do you agree with the proposal to set out in legislation the criteria that the ICO can use to determine whether to pursue a complaint in order to provide clarity and enable the ICO to take a more risk-based and proportionate approach to complaints? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree Please explain your answer, and provide supporting evidence where possible. 5.7 Enforcement Powers 388. The ICO is responsible for monitoring and enforcing the UK data protection regime. The ICO should be a strong, effective regulator that is equipped with the powers it needs to investigate compliance with the legislation and take appropriate action, where necessary, when organisations and individuals undertake unlawful data processing. 389. When organisations are using personal data unlawfully, the ICO should have the right powers available to enforce the law and take action against the genuinely bad players. The enforcement framework set out in UK GDPR and Data Protection Act 2018 provides a robust set of tools for the ICO to achieve this. This includes a suite of enforcement tools ranging from information notices, which simply require organisations to provide specific information to the ICO, through to the ability to leverage fines up to £17.5 million, or 4% of total worldwide annual turnover, whichever is higher. The aim of the enforcement regime is to promote compliance and act in a robust and proportionate manner. 390. The table below summarises the ICO’s existing enforcement powers: Power and Statutory basis
Scope
Monitor and enforce UK GDPR, including conducting investigations
The Information Commissioner’s duties to monitor and enforce the UK GDPR and to conduct investigations.
GDPR, Art.57 Information Notice Data Protection Act s.142-144
The ICO can serve an information notice on a controller or processor to request provision of information reasonably required to help the ICO carry out its statutory functions. A notice may also be served on any other person to help investigate suspected failure to comply with a Specified Failure of the UK GDPR, Data Protection Act 2018 etc (as defined below). The 134
