Ms Anna Morgan:

It has been outlined in a number of case studies in our annual report that amicable resolution is a valuable method for achieving the vindication of the rights of data subjects. In our experience, most of those who make complaints to our office are satisfied when they achieve the vindication of whatever right they had been trying without success to exercise against the data controller; for example, when they have received the information they sought in an access request or achieved the erasure of information. Generally, it is not necessary to take further enforcement steps. A question was asked about the enforcement methods that are available when we are unable to reach an amicable resolution because the data controller is not inclined to allow the data subject to exercise his or her rights. Sometimes the complainant is not prepared to accept an amicable resolution. That may relate to the general backdrop to the complaint. We often find that data protection is the prism through which many consumer issues come to the fore. For example, overcharging by banks or phone companies can be a frequent occurrence. If there is a more complicated background to the complaint, the complainant might not be prepared to engage in the amicable resolution process. When we encounter difficulties in getting a data controller to comply with a data subject's request, section 109(5) gives us the power to issue enforcement notices to direct the data controller to do a number of things, such as comply with a particular request or notify a data breach to an individual if that has not already been done. More broadly speaking, we have a range of more general enforcement powers where a complaint might turn into a statutory inquiry.