Section 22: Collection of personal data

22. Collection of personal data (1) Subject to Part VII, a data controller shall not collect personal data unless— (a) it is collected for a lawful purpose connected with a function or activity of the data controller; and (b) the collection of the data is necessary for that purpose. (2) Where a data controller collects personal data directly from a data subject, the data controller shall, at the time of collecting personal data, ensure that the data subject is informed of— (a) the fact that the data is being collected; (b) the purpose for which the data is being collected; (c) the intended recipients of the data; (d) the name and address of the data controller; (e) whether the supply of the data by the data subject is voluntary or mandatory; (f) the consequences for that data subject if all or any part of the requested data is not provided; (g) whether— (i) the data collected shall be processed; and (ii) the consent of the data subject shall be required for such processing; and (h) his right of access to, the possibility of correction of and destruction of, the personal data to be provided. (3) A data controller shall not be required to comply with subsection (2)— (a) in respect of a data subject where— (i) compliance with subsection (2) in respect of a second or subsequent collection will be to repeat, without any material difference, what was done to comply with that subsection in respect of the first collection; and (ii) not more than 12 months have elapsed between the first collection and the second or subsequent collection; (b) where— (i) compliance is not reasonably practicable at the time of collection, provided that the data controller makes available to the data subject all the relevant information specified in subsection (2) as soon as practicable; or (ii) the data is used in a form in which the data subject cannot or could not reasonably expect to be identified. D3 – 13 [Issue 7] Data Protection Act (4) Where data is not collected directly from the data subject concerned, the data controller or any person acting on his behalf shall ensure that the data subject is informed of the provisions of subsection (2). (5) Subsection (3) shall not operate to prevent a second or subsequent collection from becoming a first collection where the data controller has complied with subsection (2) in respect of the second or subsequent collection. (S. 22 came into operation on 16 February 2009.)