 | |
| Register of notifications. |
18. - (1) The Commissioner shall-
|
| |
(a) maintain a register of persons who have given notification under section 17, and |
| |
(b) make an entry in the register in pursuance of each notification received by him under that section from a person in respect of whom no entry as data controller was for the time being included in the register. |
| |
(2) Each entry in the register shall consist of the registrable particulars notified under section 17 or, as the case requires, those particulars as amended in pursuance of section 19(4).
|
| |
(3) Notification regulations may make provision as to the time as from which any entry in respect of a data controller is to be treated for the purposes of section 16 as having been made in the register.
|
| |
(4) No entry shall be retained in the register for more than the relevant time except on payment of such fee as may be prescribed by fees regulations.
|
| |
(5) In subsection (4) "the relevant time" means twelve months or such other period as may be prescribed by notification regulations; and different periods may be prescribed in relation to different cases.
|
| |
(6) The Commissioner-
|
| |
(a) shall provide facilities for making the information contained in the entries in the register available for inspection (in visible and legible form) by members of the public at all reasonable hours and free of charge, and |
| |
(b) may provide such other facilities for making the information contained in those entries available to the public as he considers appropriate. |
| |
(7) The Commissioner shall, on payment of such fee, if any, as may be prescribed by fees regulations, supply any member of the public with a duly certified copy in writing of the particulars contained in any entry made in the register.
|
| Duty to notify changes. |
19. - (1) For the purpose specified in subsection (2), notification regulations shall include provision imposing on every person in respect of whom an entry as a data controller is for the time being included in the register maintained under section 18 a duty to notify to the Commissioner, in such circumstances and at such time or times and in such form as may be prescribed, such matters relating to the registrable particulars and measures taken as mentioned in section 17(2)(b) as may be prescribed.
|
| |
(2) The purpose referred to in subsection (1) is that of ensuring, so far as practicable, that at any time-
|
| |
(a) the entries in the register maintained under section 18 contain current names and addresses and describe the current practice or intentions of the data controller with respect to the processing of personal data, and |
| |
(b) the Commissioner is provided with a general description of measures currently being taken as mentioned in section 17(2)(b). |
| |
(3) Subsection (3) of section 17 has effect in relation to notification regulations made by virtue of subsection (1) as it has effect in relation to notification regulations made by virtue of subsection (2) of that section.
|
| |
(4) On receiving any notification by virtue of subsection (1), the Commissioner shall make such amendments of the relevant entry in the register maintained under section 18 as are necessary to take account of the notification.
|
| Offences. |
20. - (1) If section 16(1) is contravened, the data controller is guilty of an offence.
|
| |
(2) Any person who fails to comply with the duty imposed by notification regulations made by virtue of section 19(1) is guilty of an offence.
|
| |
(3) It shall be a defence for a person charged with an offence under subsection (2) to show that he exercised all due diligence to comply with the duty.
|
| Preliminary assessment by Commissioner. |
21. - (1) This section applies to any processing which is of a description specified in an order made by the Secretary of State as appearing to him to be particularly likely-
|
| |
(a) to cause substantial damage or substantial distress to data subjects, or |
| |
(b) otherwise significantly to prejudice the rights and freedoms of data subjects. |
| |
(2) On receiving notification from any data controller under section 17 or under notification regulations made by virtue of section 19 the Commissioner shall consider-
|
| |
(a) whether this section applies or would apply to the proposed processing, and |
| |
(b) if so, whether the proposed processing is likely to comply with the provisions of this Act. |
| |
(3) Subject to subsection (4), the Commissioner shall, within the period of twenty-eight days beginning with the day on which he receives a notification which relates to processing to which this section applies or would apply, give a notice to the data controller stating the extent to which the Commissioner is of the opinion that the proposed processing is likely or unlikely to comply with the provisions of this Act.
|
| |
(4) Before the end of the period referred to in subsection (3) the Commissioner may, by reason of special circumstances, extend that period on one occasion only by notice to the data controller by such further period not exceeding fourteen days as the Commissioner may specify in the notice.
|
| |
(5) No processing to which this section applies shall be carried on unless the data controller has previously given the Commissioner a notification in respect of the processing under section 17 or under notification regulations made by virtue of section 19 and either-
|
| |
(a) the period of twenty-eight days beginning with the day on which the notification is received by the Commissioner (or, in a case falling within subsection (4), that period as extended under that subsection) has elapsed, or |
| |
(b) before the end of that period (or that period as so extended) the data controller has received a notice from the Commissioner under subsection (3) in respect of the processing. |
| |
(6) Where subsection (5) is contravened, the data controller shall (without prejudice to any liability for any other offence under this Act) be guilty of an offence under this subsection.
|
| |
(7) The Secretary of State may by order amend subsections (3), (4) and (5) by substituting for the number of days for the time being specified there a different number specified in the order.
|
