- Under the DPA 2018, in certain circumstances the Commissioner is restricted from issuing penalty notices or subject to additional requirements. These circumstances are:
-
- Processing data for the ‘special purposes’: The Commissioner may only issue a penalty notice to a controller or processor with respect to the processing of personal data for the special purposes 43 in specific circumstances (as set out in section 156 DPA 2018).44 These are that a determination under section 174 DPA 2018 has taken effect and a court has granted leave for the penalty notice to be given.
- Houses of Parliament: The Commissioner may not issue a penalty notice with respect to the processing of personal data where the purposes and manner of the processing are determined by or on behalf of either the House of Commons or the House of Lords.45
- The Crown Estate Commissioners and the Royal Household: The Commissioner may not issue a penalty notice to the Crown Estate Commissioners, or a person who is a controller acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall (as specified by section 209(4) DPA 2018).46
- Joint controllers – law enforcement or intelligence services processing: Where joint controllers process personal data to which Part 3 or Part 4 DPA 2018 applies (law enforcement processing or processing by the intelligence services), the Commissioner may only give the controller a penalty notice if the controller is responsible for compliance with the provision, requirement or principle in question.47
43 The ‘special purposes’ are defined in section 174(1) DPA 2018 and mean one or more of the purposes of journalism, academic purposes, artistic purposes, or literary purposes.