Data Protection Act 2018
|
Communication with data subject | ||
|
93. (1) Where a controller— | ||
(a) provides or makes available information to a data subject under section 90 , | ||
(b) provides or makes available information to, or communicates with, a data subject pursuant to a request under section 91 or 92, | ||
the controller shall take all reasonable steps to ensure the information is provided or made available, or the communication is made, as the case may be, in a concise, intelligible and easily accessible form using clear and plain language. | ||
(2) The information or communication, as the case may be, referred to in subsection (1), shall— | ||
(a) be provided to the data subject by appropriate means, including by electronic means, and | ||
(b) in the case of a communication with a data subject pursuant to a request under section 91 or 92 , in so far as is possible, be provided in the same form as that in which the request is made. | ||
(3) A controller shall not impose a charge on a data subject for information provided to him or her under section 90 or, subject to subsection (4)(i), pursuant to a request under section 91 or 92 . | ||
(4) Where a data subject makes a request to a controller under section 91 or 92 that is— | ||
(a) manifestly unfounded, or | ||
(b) excessive in nature, having regard to the number of requests made by the data subject to the controller under those sections, | ||
the controller may— | ||
(i) charge a reasonable fee to the data subject in respect of the request, having regard to the administrative cost to the controller of complying with the request, or | ||
(ii) refuse to act upon the request. | ||
(5) Where a controller, pursuant to subsection (4)(ii), refuses to act upon a request under section 91 or 92 it shall, as soon as practicable, so notify the data subject in writing. | ||
(6) A notification under subsection (5) shall include— | ||
(a) the reasons for which the controller is refusing to act upon the request under section 91 or 92 , as the case may be, pursuant to subsection (4)(ii), and | ||
(b) information relating to the right of the data subject under Chapter 3 of Part 6 to lodge a complaint with the Commission and the contact details of the Commission. | ||
(7) Where, pursuant to subsection (4)(ii), a controller refuses to act upon a request made to the controller by a data subject under section 91 or 92 , it shall be for the controller to demonstrate that the request was manifestly unfounded or excessive in nature. | ||
(8) In this section, a reference to a “data subject” shall be construed as including an individual who makes a request under section 91 (1), irrespective of whether the controller is processing personal data relating to the individual. |