Mick Wallace (Wexford, Independent) | Oireachtas source

I move amendment No. 170:

In page 96, between lines 9 and 10, to insert the following:“ Decision of Commission when inquiry under Chapter 3 conducted under section 120(1)(a)

122. (1) Where an inquiry has been conducted under section 120(1)(a), the Commission, having considered the information obtained in the inquiry, shall —

(a) if satisfied that an infringement by the controller or processor to which the inquiry relates has occurred or is occurring, make a decision to that effect, and

(b) if not so satisfied, make a decision to that effect and dismiss the complaint.

(2) Where the Commission makes a decision under subsection (1)(a), it shall, in addition, and having regard to the nature of the infringement, make a decision as to whether—

(a) an enforcement notice should be served on the controller or processor requiring it to do one or more of the following:

(i) comply with the data subject’s request to exercise his or her rights pursuant to a relevant enactment;

(ii) where the enforcement notice is given to the controller, communicate a personal data breach to the data subject;

(iii) rectify or erase personal data or restrict processing pursuant to Article 16, 17 or 18, and, in respect of that action, to comply with Article 19 and, where applicable, Article 17(2);

(iv) bring processing operations into compliance with the provisions of a relevant enactment, in a specified manner and within a specified period;

(v) refrain from taking specified actions,

(b) a corrective power should be exercised in respect of the controller or processor concerned, and where it decides to so exercise a corrective power, the corrective power that is to be exercised, or

(c) such other action as the Commission considers appropriate should be taken.

(3) The Commission, where it makes a decision referred to in subsection (2)(b), shall exercise the corrective power concerned.

(4) The Commission shall —

(a) as soon as practicable after a decision under this section is made by it, give the controller or processor concerned a notice in writing setting out —

(i) the decision and the reasons for it, and

(ii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor, and

(b) as soon as practicable after the notice under paragraph (a) is given, the complainant a notice in writing setting out—

(i) the decision and the reasons for it,

(ii) the action, if any, taken on the basis of that decision,

(iii) where applicable, the corrective power that the Commission has exercised in respect of the controller or processor.”.