6. Right of Access to Personal Data

6.—

1. The rights conferred by this section are subject to the exemptions set out in Part V, to the extent indicated in that Part, and a data controller shall determine in each case whether compliance with a request lawfully made under this section can be achieved without compromising the confidentiality of the exempt data, by severing the exempt data from any information required to be disclosed under this section.

2. Subject to the provisions of this section and sections 7 and 8, an individual is entitled, upon making a written request to a data controller—

(a) to be informed by the data controller, free of charge, whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller;

(b) if personal data are being processed as described in paragraph (a), to be given by the data controller, free of charge, a description of—

(i) the personal data of which that individual is the data subject;

(ii) the purposes for which the personal data are being, or are to be, processed; and

(iii) the recipients or classes of recipients to whom they are, or may be, disclosed;

(c) upon payment of the prescribed fee—

(i) to have communicated to that individual in an intelligible form—

(A) the information constituting any personal data of which the individual is the data subject; and

(B) any information available to the data controller as to the source of those personal data; or

(ii) where technically feasible, to have transmitted—

(A) to another data controller specified in the request; and

(B) in a structured, commonly used and machine-readable format, the personal data of that data subject, which the data subject has provided to the first mentioned data controller; and

(d) where the processing, by automatic means, of personal data of which that individual is the data subject—

(i) is for the purpose of evaluating matters relating to that individual (such as, for example, the individual’s performance at work, creditworthiness, reliability, or conduct); and

(ii) has constituted or is likely to constitute the sole basis for any decision significantly affecting the individual, to be informed by the data controller, upon payment of the prescribed fee, of the logic involved in that decision-taking.

3. An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description.

4. Subject to section 8(1), a data controller shall comply with a request under this section promptly and, in any event, before the end of the period of thirty days, or such longer maximum period as may be prescribed, beginning on the day on which the data controller has both the request and, where applicable, the payment referred to in subsection (2).

5. For the purposes of—

(a) subsection (2)(c) and (d), different amounts may be prescribed for different circumstances;

(b) subsection (4), different periods may be prescribed for different circumstances.

6. If the Commissioner is satisfied, on the written application of any individual who has made a request under this section, that—

(a) the data controller in question has, in contravention of this section, failed to comply with the request the Commissioner may order the data controller to comply with the request; or

(b) the data controller has complied with the provisions of this section in dealing with the request, the Commissioner may dismiss the application.

7. For the purposes of determining any question whether an applicant under subsection (6) is entitled to information under this section (including any question whether any relevant personal data are exempt from this section by virtue of Part V), the Commissioner—

(a) may require the information constituting any personal data processed by or on behalf of the data controller in question and any information as to the logic for any decision as mentioned in subsection (2)(d) to be made available for the Commissioner’s inspection; and

(b) shall not, pending the determination of the question in the applicant’s favour, require the information to be disclosed to the applicant or the applicant’s representatives.

8. The Commissioner may appoint a duly qualified mediator to consider any matter to be determined or inspected by the Commissioner under subsection (6) or (7) and make such recommendations to the Commissioner as the mediator thinks fit for the settlement of the matter, and the Commissioner may act on those recommendations.