Disclosures
when not
collecting
data directly
from the data
subject
22.
(1) Where the personal data is not collected from the data subject
himself/herself, the controller or his/her representative must
provide the data subject with at least the information set out below
when recording the personal data or considering communication
to a third party, and at the very latest when the data is first
disclosed, unless it is established that the data subject is in
receipt of such information:
(a) the name and address of the controller and of his/her
representative, if any;
(b) the purposes of the processing;
(c) whether compliance with the request for information is
compulsory or not, as well as what the consequences of the
failure to comply are;
(d) the existence of the a right to object, by request and free of
charge, to the intended processing of personal data relating
to him/her, if it is obtained for the purposes of direct
marketing; in which that case, the data subject shall must be
informed prior to the first disclosure of the personal data to a
third party or prior to the first use of the data for the purposes
of direct marketing on behalf of third parties;
(e) Taking in account the specific circumstances in which the
data is collected, any supporting information, as necessary
to ensure fair processing such as:
(i) the categories of data concerned,
(ii) the recipients or categories of recipients of the data,
(iii) the existence of the right to access and rectify the
personal data relating to him/her, unless such additional
information, taking into account the specific
circumstances in which the data is provided, is not
necessary to guarantee fair processing with respect to
the data subject.
(f) other information dependent on the specific nature of the
processing, which is specified by the Authority.
Draft Data Protection Bill Version 1.0
33