Disclosures
when
collecting
data directly
from the data
subject
21.
(1) When obtaining personal data directly from the data subject,
the controller or the controller’s representative shall concurrently
provide the data subject with at least the following information,
unless the data subject has already received such information- :
(a) the name and address of the controller and of his/her
representative, if any;
(b) the purposes of the processing;
(c) the existence of the right to object, by request and free of
charge, to the intended processing of personal data relating
to him/her, if it is obtained for the purposes of direct
marketing;
(d) whether compliance with the request for information is
compulsory or not, as well as what the consequences of the
failure to comply are;
(e) taking into account the specific circumstances in which the
data is collected, any supporting information, as necessary
to ensure fair processing for the data subject, such as:
(i) the recipients or categories of recipients of the data;
(ii) whether it is compulsory to reply, and what the possible
consequences of the failure to reply are;
(iii) the existence of the right to access and rectify the
personal data relating to him/her - except where such
additional information, taking into account the specific
circumstances in which the data is collected is not
necessary to guarantee accurate processing.
(f) other information dependent on the specific nature of the
processing, as specified by the Authority.
Draft Data Protection Bill Version 1.0
32