Duty to notify changes
55. A person in respect of whom an entry as a data controller is included
in the Register shall notify the Commission of changes in the registered
particulars within fourteen days.
Failure to register
56. A person who fails to register as a data controller but processes personal
data commits an offence and is liable on summary conviction to a fine of not
more than two hundred and fifty penalty units or a term of imprisonment of
not more than two years or to both.
Assessable processing
57. (1) The Minister may by Executive Instrument specify actions which
constitute assessable processing if the Minister considers the assessable
processing likely to
(a) cause substantial damage or substantial distress to a data subject,
or
(b) otherwise significantly prejudice the privacy rights of a data subject;
(2) On receipt of an application for registration, the Commission shall
consider
(a) whether the processing to which the notification relates is
assessable, or
(b) if the assessable processing complies with the provisions of this
Act.
(3) The Commission shall within twenty-eight days from the day
of receipt of the application, inform the data controller whether the processing
is likely to comply with the provisions of this Act.
(4) The Commission may extend the initial period by a further period
which does not exceed fourteen days or other period that the Commission may
specify.
(5) The assessable processing in respect of which a notification has been
given to the Commission shall not be carried on unless
(a) the period of twenty-eight days has elapsed, or
(b) before the end of that period, the data controller receives a notice
from the Commission under subsection (3).
(6) A data controller who contravenes this section commits an of- fence
and is liable on summary conviction to a fine of not more than two hundred and
fifty penalty units or to a term of imprisonment of not more than two years or
to both.