(2)
Where a data controller cannot comply with a request under section 41
without disclosing personal data relating to another person, he may
refuse the request unless (a)
the other individual has consented to the disclosure of the his
personal data to the person making the request; or
(b)
(3)
he obtains the written approval of the Commissioner.
In determining for the purposes of subsection (2)(b) whether it is
reasonable for the Commissioner to approve a request without the
consent of the other individual concerned, regard shall be had, in
particular, to(a)
any duty of confidentiality owed to the other individual;
(b)
any steps taken by the data controller with a view to seeking the
consent of the other individual;
(4)
(c)
whether the other individual is capable of giving consent; and
(d)
any express refusal of consent by the other individual.
(a)
Where a data controller has previously complied with a
request made under section 41 by a data subject, the data controller is not
obliged to comply with a subsequent identical or similar request under that
section by that data subject unless a reasonable interval has elapsed
between compliance with the previous request and the making of the
current request.
(b)
In determining, for the purposes of paragraph (a), whether
requests under section 41 are made at reasonable intervals,
regard shall be had to (i)
the nature of the data;
(ii)
the purpose for which the data are processed; and
(iii)
the frequency with which the data are altered.