150. (1) A controller or processor on which an information notice or enforcement notice or a notice under section 135(1) is served may, within 28 days from the date on which the notice is served, appeal against a requirement specified in the notice.

(2) The court, on hearing an appeal under subsection (1), shall—

(a) annul the requirement concerned,

(b) substitute a different requirement for the requirement concerned, or

(c) dismiss the appeal.

(3) This subsection applies to an appeal brought under subsection (1)—

(a) against a requirement specified in an information notice to which section 132(3) applies, or an enforcement notice to which section 133(6) applies, and

(b) that is brought within the period specified in the notice concerned.

(4) Notwithstanding any provision of this Act, the court, on hearing an appeal to which subsection (3) applies, may on application to it in that behalf, determine that non-compliance by the controller or processor concerned with a requirement specified in the notice, during the period ending with the determination or withdrawal of the appeal or during such other period as the court may determine, shall not constitute an offence.

(5) A data subject or other person affected by a legally binding decision of the Commission under Chapter 2 or 3 may, within 28 days from the date on which notice of the decision is received by him or her, appeal against the decision.

(6) The court, on hearing an appeal under subsection (5), shall—

(a) annul the decision concerned,

(b) substitute its own determination for the decision, or

(c) dismiss the appeal.

(7) Where the Commission, being the competent supervisory authority in respect of a complaint within the meaning of Chapter 2 or 3, does not comply with section 108(2) or, as the case may be, section 121(2), the complainant concerned may apply to the court for an order under subsection (8)(a).

(8) The court, on hearing an application under subsection (7), shall—

(a) order the Commission to comply with the provision concerned, or

(b) dismiss the application.

(9) The Circuit Court shall, concurrently with the High Court, have jurisdiction to hear and determine proceedings under this section.

(10) The jurisdiction conferred on the Circuit Court by this section shall be exercised by the judge for the time being assigned to the circuit where—

(a) in the case of an appeal under subsection (1), the controller or processor is established,

(b) in the case of an appeal under subsection (5), the data subject or other person resides or is established, or

(c) in the case of an application under subsection (7), the data subject resides,

or, at the option of the controller, processor, data subject or person concerned, by a judge of the Circuit Court for the time being assigned to the Dublin circuit.

(11) A decision of the Circuit Court or High Court, as the case may be, under this section shall be final save that an appeal shall lie to the High Court or Court of Appeal, as the case may be, on a point of law.

(12) For the purposes of this section, a “legally binding decision” means a decision—

F16[(a) under paragraph (a), (b) or (da) of section 109(5) or paragraph (a), (b) or (da) of section 122(4),]

F16[(b) under section 111(1)(a), 112(1), 113(2)(b) or (6)(aa), 114, 124(1)(a) or 125(1), or]

(c) to exercise a corrective power under Chapter 2 or 3.