Act
Data Protection And Privacy Act
(a)
2019
confirm whether or not the data controller holds personal
data about that data subject;
(b) give a description of the personal data which is held by the
data controller;
(c) provide the identity of a third party or a category of a third
party who has or has had access to information.
(2) A request under this section shall be made in the prescribed
form and manner.
(3) A data controller shall not comply with a request under this
section unless the data controller is given information that the data
controller may reasonably require to identify the person making the
request and to locate the data requested by that person.
(4) Where a data controller is unable to comply with the request
without disclosing data related to another individual who may be
identified from the information, the data controller shall not comply
with the request unless(a)
the other individual consents to the disclosure of the data to
the person who makes the request;
(b)
it is reasonable in all the circumstances to comply with the
request without the consent of the other individual; or
(c)
compelled by a court order.
(5) For the purposes of subsection (4)(a)
a reference to data related to another individual includes a
reference to data which identifies that individual as the
source of the data requested; and
(b) another individual may be identified from the data
disclosed if that individual can be identified from that data ,
or any other data which in the reasonable belief of the data
controller are likely to be in, or come into the possession of
the data subject who made the request.