Section 37: Right of access
as enacted (not consolidated). juris shows this Act from a copy that is not the official consolidation, so it may not carry every amendment; the amendments juris holds are listed. It does not confirm that this is the law in force today.
37. Right of access
(1) (a) Every controller shall, on the written request of a data
subject provide, at reasonable intervals, without excessive delay and,
subject to subsection (7), free of charge, confirmation as to whether or not
personal data relating to the data subject are being processed and forward
to him a copy of the data.
(b) Where a controller has a reasonable doubt concerning
the identity of a person making a request under paragraph (a), he or it may
request the provision of additional information to confirm the identity of
the data subject.
(2) Where personal data are being processed, the controller shall
provide to the data subject information relating to –
(a) the purpose of the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipient to whom the
data have been or will be disclosed;
(d) the period for which the data will be stored or, if this is
not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller
rectification or erasure of personal data or restriction of
processing of personal data concerning the data subject
or to object to the processing of the data;
(f) the right to lodge a complaint with the Commissioner;
(g) where the personal data are not collected from the data
subject, any available information as to their source;
(h) the existence of automated decision making, including
profiling, and information about the logic involved, as
well as the significance and envisaged consequences of
such processing for the data subject; and
502 Acts 2017 Acts 2017 503
(i) appropriate safeguards taken under section 36, in case
the personal data are transferred or intended to be
transferred to another country.
(3) The controller shall provide the information referred to in
subsection (2) in an intelligible form, using clear and plain language.
(4) Where the personal data are not or have not been collected
from the data subject, the controller shall not be required to provide
information where the processing is expressly prescribed by law or this
proves to be impossible or involves a disproportionate effort.
(5) (a) The controller shall, within one month of the receipt of
a request, inform the data subject in writing, whether or not any action has
been taken pursuant to subsection (1).
(b) The period specified in paragraph (a) may be extended
by a further month where necessary, taking into account the complexity
and the number of requests made.
(6) Where a controller refuses to take action on the request of a
data subject, he or it shall, within one month of the receipt of the request,
inform the data subject in writing of the reason for the refusal and on the
possibility of lodging a complaint with the Commissioner.
(7) (a) Where the request is manifestly excessive, the
controller may charge a fee for providing the information or taking the
action requested, or he or it may not take the action requested.
(b) Where the controller takes a decision under paragraph (a),
he or it shall bear the burden of proving the manifestly excessive character
of the request.