The competition framework Summary and Background Section 90: Supply of customer data: enforcement
592.This section empowers the Secretary of State to make provision for the enforcement of the customer data regulations. It provides for a model of civil enforcement as opposed to criminal penalties (subsection (2)) and enables regulations to be made allowing customers to bring their own actions for breach of the regulations before a court or tribunal (subsection (5)). By virtue of subsections (6) and (8) some of the provisions of section 89 apply to this section also.
593.Subsection (1) identifies the Information Commissioner as a potential enforcer but empowers the Secretary of State to designate other persons to act as enforcers. The regulations may also designate more than one enforcer and provide for their functions to be exercisable concurrently or jointly (see further the explanation of subsection (4) below).
594.Subsection (2)(a) and (b) set out the enforcement options referred to above. The regulations will be able to provide for enforcers to apply to a court (or tribunal) for an order that a regulated person comply with the regulations. Alternatively an enforcer may be allowed to serve an enforcement notice on a regulated person without a court order. In both cases breach of the order/notice could amount to a contempt of court.
595.Subsection (3) provides that regulations may confer on enforcers investigatory powers to enable them to fulfil their functions. The regulations may also set out sanctions for non-compliance with requirements made by an enforcer when exercising its investigatory powers (for example if a regulated person fails to provide information on request). The words in parenthesis in subsection (3)(b) make clear that the enforcement provisions should be comparable to those for breach of the customer data regulations (namely civil enforcement not criminal penalties).
596.As explained above, under subsection (4)(b) provision can be made for functions to be exercisable by more than one enforcer, whether concurrently or jointly. Where functions are exercised concurrently, subsection (4)(c) allows the regulations to make provision for a lead enforcer to take on a co-ordination role, namely to direct which enforcer can act in a particular case. To assist with that role, that subsection also allows the regulations to require the other enforcers to consult with the lead enforcer before exercising enforcement functions.
597.Finally, subsection (4)(a) enables regulations to be made requiring an enforcer (if not the Information Commissioner) to inform the Commissioner if they intend to exercise functions under the regulations. The intention is to make the Commissioner aware of potential breaches of the customer data regulations in case they raise wider subject access issues.