19. Assessment by Commissioner required for specified processing

19.—

1. This section applies to “specified processing”, being processing of a description specified in an order made by the Minister in accordance with section 74(3)(c), as appearing to the Minister to be particularly likely—

(a) to cause substantial damage or substantial distress; or

(b) to otherwise significantly prejudice the rights and freedoms of data subjects.

2. Upon receiving any information from a data controller under section 16(1), the Commissioner shall—

(a) consider whether any of the processing to which the information relates is specified processing; and

(b) if so—

(i) having regard to the information provided by the data controller, consider whether that processing is likely to comply with the provisions of this Act; and

(ii) within the period of thirty days beginning on the day on which the Commissioner received the information, give a notice to the data controller stating the extent to which, in the Commissioner’s assessment, the processing is likely or unlikely to comply with the provisions of this Act.

3. Before the end of the period referred to in subsection (2)(b)(ii), the Commissioner may, by reason of special circumstances, extend that period by issuing an extension notice to the data controller—

(a) on one occasion only; and

(b) specifying the period of the extension, which shall not exceed fourteen days.

4. No specified processing shall be carried on by a data controller unless the information required under section 16(1) has been provided to the Commissioner and either—

(a) the period of thirty days, beginning on the day on which the information is received by the Commissioner, and such further period as is specified in an extension notice under subsection (3) (in any case where such a notice is issued) has elapsed; or

(b) before the end of the period or further period (as the case may require) referred to in paragraph (a), the data controller receives a notice from the Commissioner under subsection (2)(b)(ii) in respect of the processing.

5. A data controller who contravenes subsection (4) or processes personal data other than in a manner in compliance with the assessment made by the Commissioner in a notice under subsection (2)(b)(ii) commits an offence and shall be liable upon—

(a) summary conviction in a Parish Court, to a fine not exceeding five million dollars or to imprisonment for a term not exceeding five years; or

(b) conviction on indictment in a Circuit Court to a fine, or to imprisonment for a term not exceeding ten years.

6. The Minister may by order published in the Gazette amend this section by substituting a different number of days in respect of any period or further period referred to in subsection (2)(b)(ii), (3)(b) or (4)(a).