Data Protection Act 2018
Civil proceedings for contravention of section 26
27. (1) A person who suffers loss or harm as a result of a contravention of section 26(1) may, subject to section 154, bring proceedings against the person specified in subsection (2) seeking relief by way of—
(a) an injunction or declaration, or
(b) damages,
or both.
(2) The person specified for the purposes of subsection (1) is—
(a) where it is alleged that the contravention was committed by a Commissioner, member of staff of the Commission or an authorised officer and the applicant under that subsection is seeking an injunction or declaration, the Commissioner, member of staff or authorised officer concerned,
(b) where it is alleged that the contravention was committed by a Commissioner, member of staff of the Commission or an authorised officer and the applicant under that subsection is seeking damages, the Commission, and
(c) where it is alleged that the contravention was committed by a person other than a Commissioner, member of staff of the Commission or an authorised officer, that person.
(3) Proceedings under subsection (1), in so far as they seek the relief referred to in paragraph (b) of that subsection, shall be founded on tort.