Acts 2017
481
(3) The Judge may, on application made by the Commissioner,
extend the period specified in subsection (2) for such period as he thinks fit.
9.
Enforcement notice
(1) Where the Commissioner is of the opinion that a controller or
a processor has contravened, is contravening or is about to contravene this
Act, the Commissioner may serve an enforcement notice on him requiring
him to take such steps within such period as may be specified in the notice.
(2) Notwithstanding subsection (1), where the Commissioner is of
the opinion that a person has committed an offence under this Act, he may
investigate the matter or cause it to be investigated by an authorised officer.
(3)
An enforcement notice served under subsection (1) shall –
(a) specify the provision of this Act which has been, is
being or is likely to be, contravened;
(b) specify the measures that shall be taken to remedy or
eliminate the situation which makes it likely that a
contravention will arise;
(c) specify a period which shall not be less than 21 days
within which those measures shall be implemented; and
(d) state that a right of appeal is available under section 51.
(4) On complying with an enforcement notice, the controller
or processor, as the case may be, shall, not later than 21 days after
compliance, notify –
(a) the data subject concerned; and
(b) where such compliance materially modifies the data
concerned, any person to whom the data was disclosed
during the period beginning 12 months before the date
of the service of the notice and ending immediately
before compliance,
of any amendment.
(5) Where the Commissioner considers that any provision of the
enforcement notice may not be complied with to ensure compliance with
this Act, he may vary the notice and, where he does so, he shall give written
notice to the person on whom the notice was served.