The Information Commissioner, enforcement and offences
The Act provides for the Commissioner to continue as the supervisory authority in the UK in relation to the protection of personal data (see sections 115(1) and 116(1)).
	The powers of the Commissioner to investigate and sanction data protection breaches have changed and grown over time as all types of data, including personal data, are capable of being accessed, analysed, transmitted, and stored in dramatically different ways to 30 years ago. Under the 1998 Act, as originally enacted, the Commissioner could only serve enforcement notices and her powers to impose fines were only introduced under the Criminal Justice and Immigration Act 2008 which enabled the Commissioner to issue a civil monetary penalty notice of up to £500,000 in respect of the most serious breaches. The GDPR, and the Act, confer new powers on the Commissioner to impose a maximum fine of £17 million (€20 million) or 4 percent of turnover in the most serious cases. The GDPR and LED require fines to be effective, proportionate and dissuasive in each individual case. The Act ensures that the Commissioner’s powers to issue fines are subject to certain safeguards, including a requirement for the penalty notice to be preceded by a notice of intent, for the opportunity to make representations against a proposed fine, and for information to be given about the right of appeal under the Act in relation to any penalty notice subsequently issued or the amount specified in that notice.
	The 1998 Act included certain criminal offences relating to making a false statement in response to an information notice, obtaining or disclosing personal data without the data controller’s consent and general offences relating to compliance with warrants etc and misconduct of the Commissioner’s own officers. Most prosecutions were brought under section 55 of the 1998 Act, where a person knowingly or recklessly obtained, disclosed or procured the disclosure of, personal data without the data controller’s consent. The maximum penalty was an unlimited fine. The Act reproduces many of the criminal offences in the 1998 Act with modifications to account for changes to the legal framework brought by the GDPR and introduces a small number of new offences to deal with emerging threats.
	In June 2016, Dame Fiona Caldicott, the National Data Guardian for Health and Care published her Review of Data Security Consent and Opt-Outs2 recommending that the Government should criminalise the deliberate re-identification of individuals whose personal data is contained in anonymised data. On 1 March 2017, the Government published the UK Digital Strategy3 and committed to create a new offence along these lines. The Act provides for such an offence in section 171.