 | |
| |
PART III |
| |
NOTIFICATION BY DATA CONTROLLERS |
| Preliminary. |
15. - (1) In this Part "the registrable particulars", in relation to a data controller, means-
|
| |
(a) his name and address, |
| |
(b) if he has nominated a representative for the purposes of this Act, the name and address of the representative, |
| |
(c) a description of the personal data being or to be processed by or on behalf of the data controller and of the category or categories of data subject to which they relate, |
| |
(d) a description of the purpose or purposes for which the data are being or are to be processed, |
| |
(e) a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data, |
| |
(f) the names, or a description of, any countries or territories outside the European Economic Area to which the data controller directly or indirectly transfers, or intends or may wish directly or indirectly to transfer, the data, and |
| |
|
| |
(i) personal data are being, or are intended to be, processed in circumstances in which the prohibition in subsection (1) of section 16 is excluded by subsection (2) or (3) of that section, and
|
| |
(ii) the notification does not extend to those data,
|
| |
a statement of that fact. |
| |
(2) In this Part-
|
| |
"fees regulations" means regulations made by the Secretary of State under section 17(5) or 18(4) or (7); |
| |
"notification regulations" means regulations made by the Secretary of State under the other provisions of this Part; |
| |
"prescribed", except where used in relation to fees regulations, means prescribed by notification regulations. |
| |
(3) For the purposes of this Part, so far as it relates to the addresses of data controllers-
|
| |
(a) the address of a registered company is that of its registered office, and |
| |
(b) the address of a person (other than a registered company) carrying on a business is that of his principal place of business in the United Kingdom. |
| Prohibition on processing without registration. |
16. - (1) Subject to the following provisions of this section, personal data must not be processed unless an entry in respect of the data controller is included in the register maintained by the Commissioner under section 18 (or is treated by notification regulations made by virtue of section 18(3) as being so included).
|
| |
(2) Except where section 21 applies to the processing, subsection (1) does not apply in relation to personal data consisting of information which falls neither within paragraph (a) of the definition of "data" in section 1(1) nor within paragraph (b) of that definition.
|
| |
(3) If it appears to the Secretary of State that processing of a particular description is unlikely to prejudice the rights and freedoms of data subjects, notification regulations may provide that, in such cases as may be prescribed, subsection (1) is not to apply in relation to processing of that description.
|
| |
(4) Subsection (1) does not apply in relation to any processing whose sole purpose is the maintenance of a public register.
|
| Notification by data controllers. |
17. - (1) Any data controller who wishes to be included in the register maintained under section 18 may give a notification to the Commissioner under this section.
|
| |
(2) A notification under this section must specify in accordance with notification regulations-
|
| |
(a) the registrable particulars, and |
| |
(b) a general description of measures to be taken for the purpose of complying with the seventh data protection principle. |
| |
(3) Notification regulations made by virtue of subsection (2) may provide for the determination by the Commissioner, in accordance with any requirements of the regulations, of the form in which the registrable particulars and the description mentioned in subsection (2)(b) are to be specified, including in particular the detail required for the purposes of section 15(1)(c), (d), (e) and (f) and subsection (2)(b).
|
| |
(4) Notification regulations may make provision as to the giving of notification-
|
| |
|
| |
(b) in other cases where two or more persons are the data controllers in respect of any personal data. |
| |
(5) The notification must be accompanied by such fee as may be prescribed by fees regulations.
|
| |
(6) Notification regulations may provide for any fee paid under subsection (5) or section 18(4) to be refunded in prescribed circumstances.
|
