Gibraltar: Enforcement & Redress

Part VI (ss.135–183) of the Data Protection Act 2004 and Art. 83 Gibraltar GDPR vest the GRA (as Information Commissioner) with comprehensive investigative, corrective, and fining powers: Information Notices (s.136), Assessment Notices including compulsory inspection and audit powers (s.140), Enforcement Notices requiring specific compliance steps or ordering suspension of processing/transfers (s.142), and Penalty Notices (s.147). Administrative fine ceilings under Art. 83 Gibraltar GDPR and s.149 DPA 2004 mirror the GDPR two-tier structure converted into Pound Sterling: up to £8,700,000 or 2% of total worldwide annual turnover (standard tier, Art. 83(4)) and up to £17,500,000 or 4% of total worldwide annual turnover (higher tier, Art. 83(5)–(6)). In addition, the DPA 2004 creates criminal offences for unlawfully obtaining, disclosing, or retaining personal data without the controller's consent (s.162), re-identifying de-identified personal data (s.163), altering/concealing records with intent to prevent DSAR disclosure (s.165), enforcing unlawful forced subject access requests as a condition of employment/service (s.176), and obstructing or making false statements to the Commissioner (Sch. 15). Under s.154 DPA 2004, appeals against GRA Information, Assessment, Enforcement, or Penalty Notices lie to the Magistrates' Court (and onward to the Supreme Court of Gibraltar). Data subjects have a direct statutory right to lodge complaints with the GRA (Art. 77 / s.157 DPA 2004), seek judicial compliance orders in the Supreme Court of Gibraltar (Art. 79 / s.159 DPA 2004), claim compensation for material and non-material damage (including distress) under Art. 82 Gibraltar GDPR and s.160 DPA 2004, and mandate non-profit representative bodies on an opt-in basis under Art. 80(1) Gibraltar GDPR and s.178 DPA 2004.