(1) An enforcement notice must -
(a) state what the person has failed or is failing to do, and
(b) give the Commissioner's reasons for reaching that opinion.
(2) In deciding whether to give an enforcement notice in reliance on section 149(2), the Commissioner must consider whether the failure has caused or is likely to cause any person damage or distress.
(3) In relation to an enforcement notice given in reliance on section 149(2), the Commissioner's power under section 149(1)(b) to require a person to refrain from taking specified steps includes power -
(a) to impose a ban relating to all processing of personal data, or
(b) to impose a ban relating only to a specified description of processing of personal data, including by specifying one or more of the following -
(i) a description of personal data;
(ii) the purpose or manner of the processing;
(iii) the time when the processing takes place.
(4) An enforcement notice may specify the time or times at which, or period or periods within
…