Data Protection Act 2018

Commission to consider investigation report

140. (1) The Commission, on receipt under section 139 (2) of an investigation report, shall, for the purposes of the inquiry concerned, consider the report and any submissions annexed to it.

(2) Where the Commission, in considering the documents referred to in subsection (1), forms the view that further information is required for the purpose of enabling it to make a decision under section 111 , 112 , 124 or 125 , or a draft decision under section 113 , as the case may be, it may, as it considers appropriate, do one or more than one of the following:

(a) conduct an oral hearing;

(b) give the controller or processor to which the investigation concerned relates—

(i) a copy of the investigation report, and

(ii) a notice in writing stating that the controller or processor concerned may, within 21 days from the date on which the notice was served on it (or such further period not exceeding 21 days as the Commission allows), make submissions in writing to the Commission in relation to such matters as the Commission may specify in the notice;


(c) direct an authorised officer to conduct such further investigation into such matters as the Commission considers necessary having regard to the investigation report and submissions (if any) annexed to it.

(3) Schedule 3 shall, with any necessary modification, have effect for the purposes of an oral hearing referred to in subsection (2)(a).

(4) Sections 138 and 139 and this section shall apply to a further investigation conducted in compliance with a direction under subsection (2)(c), as if the reference to an authorised officer in those sections was a reference to an authorised officer directed under subsection (2)(c) to conduct the further investigation.