(b)
shall not, where the data are kept for direct marketing and other
purposes, process the data for direct marketing after the expiry of
28 days.
(4)
The data controller shall notify the data subject in writing of any action
taken under subsections (2) and (3) and, where appropriate, inform him of
the other purposes for which the personal data is being processed.
(5)
Where a data controller fails to comply with a notice under
subsection (1), the data subject may appeal to the Tribunal.
(6)
Where a data controller fails to comply with an order of the Tribunal, he
shall commit an offence.
31.
Transfer of personal data
(1)
Subject to subsection (2), no data controller shall, except with the
written authorisation of the Commissioner, transfer personal data to
another country.
(2)
The Eighth data protection principle specified in the First Schedule
shall not apply where –
(a)
the data subject has given his consent to the transfer;
(b)
the transfer is necessary –
(i)
for the performance of a contract between the data
subject and the data controller, or for the taking of steps at
the request of the data subject with a view to his entering
into a contract with the data controller;
(ii)
for the conclusion of a contract between the data
controller and a person, other than the data subject, which
is entered at the request of the data subject, or is in the
interest of the data subject, or for the performance of such
a contract;