Part 5: Data Protection and Privacy Enforcement Section 101: Penalty notices
Section 101 makes changes to the provisions for imposing penalties in Schedule 16 to the DPA 2018. Before issuing a penalty notice to a person, the Commissioner must inform the person of the intention to do so, by issuing a notice of intent. Section 101 changes the rules about the time within which a penalty notice given in reliance on a notice of intent must be issued to allow for the Commissioner to have more time to issue a final penalty notice after issuing a notice of intent where needed.
	Subsection (1) is self-explanatory.
	Subsection (2) repeals paragraph 2(2) and (3) of Schedule 16 and subsection (3) inserts new sub-paragraph A1 and B1 into paragraph 4 of that Schedule. This provides for the Commissioner to give a penalty notice within 6 months of giving a notice of intent but allows the Commissioner to issue a penalty notice outside of the 6 month time limit if it is not reasonably practicable to issue a final penalty notice within this timeframe. In such circumstances, the Commissioner is instead required to issue a final penalty notice "as soon as reasonably practicable" after issuing the notice of intent. This allows the Commissioner to have sufficient time, after issuing a notice of intent, to consider oral or written representations and complete its investigations, where needed. This also places new requirements on the Commissioner to let the person know the outcome of its investigation by giving written notice where the Commissioner has decided not to give a penalty notice. This notice should also be given within 6 months of the day the notice is given or as soon as reasonably practicable thereafter.
	Subsection (4) introduces a new requirement in section 160 of the DPA 2018. This requires the Commissioner to produce and publish guidance setting out the circumstances in which the Commissioner needs longer than 6 months to make a decision whether or not to issue a penalty notice.