134. (1) Without prejudice to Articles 58(2) and 66 of the Data Protection Regulation and subsection (4), the Commission, where it considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects under a relevant enactment, until steps or further steps are taken under the relevant enactment, may, on notice to the controller or processor concerned, make an application in a summary manner to the High Court for an order under subsection (2).

(2) The High Court may determine an application under subsection (1) by—

(a) making any order that it considers appropriate, including an order suspending, restricting or prohibiting—

(i) the processing by the controller or processor of the personal data concerned, or

(ii) the transfer by the controller or processor of such data to a recipient in a third country or to an international organisation,

for such period, or until the occurrence of such event, as is specified in the order, and

(b) giving to the Commission any other direction that the High Court considers appropriate.

(3) The Commission shall, on complying with a direction of the High Court under subsection (2)(b), give notice in writing to the controller or processor concerned of the Commission’s compliance with the direction.

(4) Where the Commission considers that the immediate suspension, restriction or prohibition of the processing of personal data or the transfer of such data to a recipient in a third country or to an international organisation is necessary in order to protect the rights and freedoms of data subjects under a relevant enactment, it may apply in a summary manner exparte to the High Court for an interim order under subsection (6).

(5) An application under subsection (4) shall be grounded on an affidavit sworn by or on behalf of the Commission.

(6) (a) The High Court may, on an application under subsection (4), where, having regard to the circumstances of the case, the Court considers it necessary to do so for the protection of the rights and freedoms of data subjects, make an interim order suspending, restricting or prohibiting—

(i) the processing by the controller or processor of the personal data concerned, or

(ii) the transfer by the controller or processor of such data to a recipient in a third country or to an international organisation.

(b) Without prejudice to subsection (7), where an interim order is made under this subsection, the Commission shall, as soon as is practicable, serve a copy of the order and of the affidavit referred to in subsection (5) on the controller or processor concerned.

(c) An interim order under this subsection shall have effect for such period, not exceeding 7 working days, as is specified in the order, and shall cease to have effect on the determination by the High Court of an application under subsection (1).

(7) (a) An interim order under subsection (6) shall take effect on notification of its making being given to the controller or processor.

(b) Oral communication to the controller or processor by or on behalf of the Commission of the fact that an interim order has been made, together with production of a copy of such order, shall, without prejudice to any other form of notification, be taken to be sufficient notification to the controller or processor concerned of the making of the order.

(8) The Commission shall communicate the details of an order made by the High Court under this section to the—

(a) European Commission,

(b) European Data Protection Board, and

(c) other supervisory authorities concerned.