Part 6: Enforcement Section 167: Compliance orders
This section gives a data subject the right to apply for a court order against a controller or processor if their rights under the data protection legislation (other than Part 4) have been infringed – for example, their rights to access, portability, rectification and erasure. This gives effect to the rights in Article 79 of the GDPR and Article 54 of the LED and is broadly equivalent to the rights to apply for court orders contained in sections 7, 10, 11, 12 and 14 of the 1998 Act, but also extends to the new rights given by the GDPR and the LED. This section does not apply to infringements of Part 4, as there are separate provisions in Part 4 enabling data subjects to apply for court orders.
	Subsection (1) sets out the right to apply for a court order if the data subject’s rights have been infringed.
	Subsection (2) sets out the powers exercisable by the court. The court can make an order against the controller in relation to the processing, or a processor acting on that controller’s behalf. The court order can instruct the controller or processor to take certain steps as specified in the court order, or to refrain from taking certain steps.
	Subsection (3) explains that the court order may specify when the steps in the order must be taken, or the period during which they must be taken.
	Subsection (4) confirms that a data subject can apply for a court order under this section in relation to an infringement of their rights under the GDPR, in accordance with Article 79(1) of the GDPR, but not in relation to an infringement of their rights under Part 4.
	Subsection (5) provides that where there are joint controllers under Part 3 whose responsibilities have been determined in accordance with the relevant provisions in Part 3, the court can only make an order against the controller which is responsible for complying with the provision of the data protection legislation which has been breached.