What Needs to be Done Prior to Collection

Contact the data subject

Contact the Commission

11 (1) The controller shall, at the time of collection of the personal data from the data subject, provide the latter, in an appropriate and explicit way, with at least the following information:

(a) his identity and the identity of his representative, if any;

(b) the purpose of the processing;

(2) The controller shall also inform the data subject about the following:-

(a) the recipients or the categories of recipients of the data;

and

(b) the existence of the right of access to and rectification of the data;

(c) whether the data subject is obliged to provide assistance, by virtue of which provisions, and the consequences of his refusal, if any; provided that this notification is necessary for securing legitimate processing in each case.

(3)(a) The provisions of subsection (1) shall also apply where the data is collected from third parties or where it is anticipated that they will be communicated to third parties, and the data subject shall be informed during its recording or at its first communication, as the case may be.

(b) The provisions of paragraph (a) shall not apply, especially in cases where the processing is performed for statistical and historical purposes or for purposes of scientific research if it is impossible to inform the data subject or where disproportionate effort is necessary in order to inform him, or if the communication of data is provided by another law, provided that in each case a license is issued by the Commissioner.

(4) The obligation to inform under subsections (1), (2) and (3) may, on the application of the controller, be waived wholly or partly, by decision of the Commissioner where the collection of personal data is performed for the purposes of defence, national needs or national security of the Republic or for the prevention, detection, investigation and prosecution of criminal offences

(5) Without prejudice to the rights of the data subject referred to in sections 12 and 13, there is no obligation to inform where the collection is made solely for journalistic purposes.

Contact the Commission

Controller’s duty to notify

7 (1) The controller must notify the Commissioner in writing about the establishment and operation of a filing system or the commencement of processing.

(2) In the notification referred to in subsection (1), the controller must state:

(a) his full name, business name or title and his address. If the controller is not established in the Republic, he must state, in addition, the full name, business name or title and address of his representative in the Republic;

(b) the address where the filing system is established or the main equipment necessary for the processing is installed;

(c) a description of the purpose of the processing of the data which is or is intended to be processed or which is included or intended to be included in the filing system;

(d) a description of the category or categories of data subjects;

(e) the categories of data which are or are intended to be processed or which are included or intended to be included in the filing system;

(f) the period of time for which he intends to carry out the processing or to keep the filing system;

(g) the recipients or categories of recipients to whom he communicates or may communicate the data;

(h) the proposed transmissions of data to third countries and the purpose thereof

(i) the basic characteristics of the system and the measures for the security of the filing system or of the processing.