158 Compliance notice
(1) The information commissioner may give an agency a notice (compliance notice) if the commissioner is satisfied on reasonable grounds that the agency—
(a) has done an act or engaged in a practice in contravention of the agency's obligation to comply with the privacy principles; and
(b) the act or practice—
(i) is a serious or flagrant contravention of the obligation; or
(ii) is of a kind that has been done or engaged in by the agency on at least 5 separate occasions within the last 2 years.
(2) A compliance notice may require an agency to take stated action within a stated period for the purpose of ensuring compliance with the obligation.