11. Right to prevent processing

11.—

1. Subject to subsection (3), on any of the grounds set out in subsection (2) an individual is entitled at any time, by notice in writing to the data controller, to require the data controller—

(a) within a period which is reasonable in the circumstances, to cease; or

(b) not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which the individual is the data subject.

2. The grounds referred to in subsection (1) are that, for reasons which shall be specified in the notice under subsection (1)—

(a) the processing of the personal data, or the processing of the personal data for that purpose or in that manner, is causing or is likely to cause, substantial damage or substantial distress to the data subject or to another, and that the damage or distress caused or likely to be caused (as the case may be) is unwarranted;

(b) the personal data is incomplete, or irrelevant, having regard to the purpose of the processing;

(c) the processing of the personal data, or the processing of the personal data for that purpose or in that manner, is prohibited under any law; or

(d) the personal data has been retained by the data controller for longer than the period of time for which it may be retained by the data controller under any law.

3. Subsection (1) does not apply—

(a) in a case where any of the conditions set out in section 23(1) is met; or

(b) in such other cases as the Minister may specify by order in accordance with section 74(3)(b).

4. A data controller who receives a notice under subsection (1) shall, within twenty-one days after receiving the notice, give the individual who gave the notice a written statement—

(a) that the data controller has complied or intends to comply with the notice; or

(b) of the data controller’s reasons for regarding the notice as, to any extent, unjustified and the extent (if any) to which the data controller has complied or intends to comply with the notice.

5. If the Commissioner is satisfied, on the written application of any individual who has given a notice under subsection (1) which appears to the Commissioner to be justified, or to be justified to any extent, that the data controller in question has failed to comply with the notice, the Commissioner may order the data controller to take such steps for complying with the notice (or complying with the notice to such extent) as the Commissioner thinks fit.

6. The failure by a data subject to exercise the rights conferred on that individual by subsection (1) or section 12(2) shall not be construed as affecting any other right conferred on the data subject by this Part.