(5)
Any person who offers to sell personal data where such personal
data has been obtained in breach of subsection (1) shall commit an offence.
(6)
For the purposes of subsection (5), an advertisement indicating that
personal data is or may be for sale, constitutes an offer to sell the personal
data.
30.
Processing of personal data for direct marketing
(1)
A person may, at any time, by notice in writing, request a data
controller –
(a)
to stop; or
(b)
not to begin,
the processing of personal data in respect of which he is a data subject,
for the purposes of direct marketing.
(2)
Where the data controller receives a request under subsection (1)(a), he
shall, as soon as reasonably practicable and in any event not more than
28 days after the request has been received –
(a)
where the data are kept only for purposes of direct marketing,
erase the data; and
(b)
where the data are kept for direct marketing and other purposes,
stop processing the data for direct marketing.
(3)
Where the data controller receives a request under subsection (1)
(b), he
(a)
shall, where the data are kept only for the purpose of direct
marketing, as soon as reasonably practicable and in any event not
more than 28 days after the request has been received, erase the
data; or