Detail

(Acts 11 of 2011 and 2 of 2015 and Statutory Instrument 4/2023)

Act 11 of 2011 .. in force 31 January 2023 Part I, sections 32 to 43 of Part III, Part VI and paragraphs (a) to (g) of Schedule 2 (S.I. 4/2023)

Amended by Act 2 of 2015 .. in force 13 April 2015

ARRANGEMENT OF SECTIONS

PART 1
PRELIMINARY

1.	Short title and commencement
2.	Interpretation
3.	Application
4.	State to be bound

PART 2
APPOINTMENT, FUNCTIONS AND POWERS OF THE DATA PROTECTION COMMISSIONER

5.	Appointment of Data Protection Commissioner
6.	Resources of the office of the Commissioner
7.	Restriction on employment
8.	Tenure of office
9.	Functions of the Commissioner
10.	Independence of functions
11.	Oath and confidentiality
12.	Powers of the Commissioner
12A.	Privacy impact assessment
13.	Delegation of functions of the Commissioner
14.	Power of the Commissioner to obtain information
15.	Contents of information notice
16.	Failure or refusal to comply with information notice
17.	Insufficient information under the information notice
18.	Powers of investigation
19.	Form of complaint
20.	Notice of investigation
21.	Power to request assistance
22.	Powers of entry and search
23.	Warrant to enter and search premises
24.	Obstruction of Commissioner or authorized officer
25.	Power of Commissioner to issue enforcement notice
26.	Contents of enforcement notice
27.	Failure to comply with enforcement notice an offence
28.	Investigations in private
29.	Referral to Director of Public Prosecutions
30.	Instruments of the Commissioner
31.	Protection of the Commissioner and staff

PART 3
OBLIGATION ON DATA CONTROLLERS

32.	Data Protection Principles
33.	Collection of personal data
34.	Consent for processing of personal data
35.	Criteria for processing sensitive personal data
36.	Processing of sensitive personal data
37.	Processing concerning health or medical purposes
38.	Processing and disclosure for research and statistical purposes
39.	Processing concerning legal offences
40.	Accuracy of personal data
41.	Use of personal data
42.	Security of personal data
43.	Duty to destroy personal data
44.	Unlawful disclosure of personal data
45.	Transfer of personal data

PART 4
REGISTRATION OF DATA PROTECTION CONTROLLERS

46.	Requirement to register
47.	Registration as a data controller
48.	Duration of registration
49.	Register of Data Controllers
50.	Inspection of Register
51.	Certificate issued by Commissioner

PART 5
RIGHTS OF DATA SUBJECTS AND OTHERS

52.	Right to access personal data
53.	Compliance with request for access to personal data
54.	Discretion in relation to access to personal data
55.	Denial of access to personal data
56.	Right of rectification, etc., of inaccurate personal data
57.	Right to prohibit processing of personal data for direct marketing
57A.	Employees protection

PART 6
EXEMPTIONS

58.	National Security
59.	Crime and taxation
60.	Health and social work
61.	Regulatory activities
62.	Journalism, literature and art
63.	Research, history and statistics
64.	Information available to the public under an enactment
65.	Disclosure required by law or in connection with legal proceedings
66.	Legal professional privilege
67.	Domestic purposes
68.	Written authorization of Commissioner in certain cases

PART 7
MISCELLANEOUS

69.	Appeals to Court
70.	Hearing of proceedings
71.	Offences and penalties
72.	Offences by directors, etc., of bodies corporate
73.	Annual Report
74.	Regulations
Schedule 1
Schedule 2