Transparent information, communication and modalities for the exercise of the rights of the data subject

21.(1) The data controller shall take appropriate measures to provide any information referred to in section 19 and section 20 and any communication under sections 10 to 18 and section 63 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child.

(2) The information pursuant to subsection (1) shall be provided in writing, or by other means, including, where appropriate, by electronic means.

(3) When requested by the data subject, the data controller may provide the information, pursuant to his rights under sections 10 to 15 and 18 orally, provided that the identity of the data subject is verified.

(4) The data controller shall facilitate the exercise of data subject rights under sections 10 to 15 and 18.

(5) The data controller shall provide information on action taken on a request under sections 10 to 15 and 18 to the data subject without undue delay and in any event within one month of receipt of the request.

(6) The period of time referred to in subsection (5) shall be extended by two months where necessary, taking into account the complexity and number of the requests under sections 10 to 15 and 18.

(7) The data controller shall inform the data subject of any extension granted pursuant to subsection (6) within one month of receipt of the request, together with the reasons for the delay.

(8) Where the data subject makes the request pursuant to his rights under sections 10 to 15 and 18 by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

(9) Where the data controller does not take action on the request of the data subject under this section, the data controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with the Commissioner or appealing to the High Court.

(10) Information provided under section 18 and section 19 and any communication and any actions taken under sections 10 to 15 and 18 and section 63 shall be provided free of charge.

(11) Where requests referred to in this section from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may either

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

(12) The data subject may object to the decision of a data controller made pursuant to subsection (11) by lodging a complaint with the Commissioner or appealing to the Tribunal.

(13) For the purposes of subsection (12), the data controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of a request referred to in subsection (11).

(14) Where a data controller has reasonable doubts concerning the identity of the individual making a request pursuant to sections 10 to 18, the data controller may request the provision of additional information necessary to confirm the identity of the data subject.

(15) The information to be provided to data subjects pursuant to section 19 and section 20 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing and where the icons are presented electronically they shall be machine-readable.

(16) The Minister in consultation with the Commissioner, may make regulations for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons.