Section 23: Collection of personal data

23. Collection of personal data (1) Subject to section 44, a controller shall not collect personal data unless – (a) it is done for a lawful purpose connected with a function or activity of the controller; and (b) the collection of the data is necessary for that purpose. (2) Subject to subsection (3), where a controller collects personal data directly from a data subject, the controller shall, at the time of collecting the personal data, ensure that the data subject concerned is informed of – (a) the identity and contact details of the controller and, where applicable, its representative and any data protection officer; 488 Acts 2017 Acts 2017 489 (b) the purpose for which the data are being collected; (c) the intended recipients of the data; (d) whether or not the supply of the data by that data subject is voluntary or mandatory; (e) the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (f) the existence of the right to request from the controller access to and rectification, restriction or erasure of personal data concerning the data subject or to object to the processing; (g) the existence of automated decision making, including profiling, and information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; (h) the period for which the personal data shall be stored; (i) the right to lodge a complaint with the Commissioner; (j) where applicable, that the controller intends to transfer personal data to another country and on the level of suitable protection afforded by that country; and (k) any further information necessary to guarantee fair processing in respect of the data subject’s personal data, having regard to the specific circumstances in which the data are collected. (3) A controller shall not be required to comply with subsection (2) where – (a) the data subject already has the information referred to in subsections (1) and (2); or (b) the data are not collected from the data subject and – (i) the provision of such information proves impossible or would involve a disproportionate effort; or 490 Acts 2017 Acts 2017 491 (ii) the recording or disclosure of the data is laid down by law. (4) Where data are not collected directly from the data subject concerned, the controller or any person acting on his or its behalf shall ensure that the data subject is informed of the matters specified in subsection (2).