- Serve an information notice on any public authority. This will require the public authority to supply specified information to the Commissioner. This may happen when the information is needed to determine whether an access request has been handled properly, to determine a public authority's compliance with the requirements of Part 1 of the Freedom of Information Act and Part 2 of the Environmental Information Regulations or to determine compliance with the statutory codes of practice.
- Issue a decision notice following his consideration of a complaint. This will set out whether, in the Commissioner's view, the Act or the Regulations have been complied with. Where a public authority has failed to meet a requirement of the Act or the Regulations, the notice will specify the steps it must take to comply with that requirement. It will also specify a timescale for doing so.
- Serve an enforcement notice on the public authority. The notice will specify the steps that the public authority needs to take to bring about its compliance with any of the requirements of the Freedom of Information Act or the Environmental Information Regulations. This notice will also specify a timescale for doing so.
Failure to comply with an information, decision or enforcement Notice may be dealt with as though the public authority had committed contempt of court.
A complainant or a public authority may appeal to the Information Tribunal against a decision notice. A public authority can also appeal to the Information Tribunal against any Information Notice or Enforcement Notice served on it. On hearing an appeal, the Information Tribunal may uphold the notice in its entirety, substitute an alternative notice or dismiss the notice completely.
The decision of the Information Tribunal may, in turn, be appealed on a point of law to the High Court of Justice (England and Wales), Court of Session (Scotland) or High Court of Justice in Northern Ireland.
Under the Data Protection Act the Information Commissioner can:
- In certain circumstances, serve an information notice and assess compliance with the Acts. This requires a data controller to provide the Commissioner with specified information within a certain time period, which will help him to assess compliance.
- Serve an enforcement notice ordering compliance where there has been a breach or an ongoing breach of the Act, which requires data controllers to take specified steps or to stop taking steps in order to comply with the law.