(e) planned trans-border flow of personal information; and
(f) a general description allowing a preliminary assessment of the
suitability of he information security measures to be implemented by
the data controller to ensure the confidentiality, integrity and
availability of the information which is to be processed.
(3) Subject to subsection (4), a data controller shall give notice each time
personal information is received or processed.
(4) Changes in the name and address of the data controller shall be notified
within one week, and changes to the notification which concern subsection
2(b) to (f) shall be notified within one year of the previous notification, if
they are of more than incidental importance.
(5) Any processing which departs from that which has been notified in
accordance with the provisions of subsection 2(b) to 2(f) shall be recorded
and kept for at least three years.
(6) The Commission may –
(a) prescribe more detailed rules concerning the procedure for
submitting notifications; and
(b) by notice exempt certain categories of information processing which
are unlikely to infringe the legitimate interests of a data subject from
the notification requirements referred to in this section.
(7) The Commission shall maintain an up-to-date register of the information
processing notified to it.
Codes of conduct
54
(1) The Commission may, from time to time, issue, approve, amend or revoke a