Examination scripts
73. Personal data which consists of information recorded by candidates during
an academic, professional or other examination is exempt from the provisions of
this Act.
Professional privilege
74. Personal data is exempt from the subject information provisions if it
consists of information in respect of which a claim to professional privilege or
confidentiality between client and a professional adviser could be maintained in
legal proceedings.
Enforcement
Enforcement notice
75. (1) Where the Commission is satisfied that a data controller has
contravened or is contravening any of the data protection principles, the
Commission shall serve the data controller with an enforcement notice to
require that data controller to do any of the following:
(a) to take or refrain from taking the steps specified within the time
stated in the notice,
(b) to refrain from processing any personal data or personal data of
a description specified in the notice; or
(c) to refrain from processing personal data or personal data of a
description specified in the notice for the purposes specified or in
the manner specified after the time specified.
(2) In deciding whether to serve an enforcement notice, the Com- mission
shall consider whether the contravention has caused or is likely to cause damage
or distress to any person.
(3) An enforcement notice issued in respect of a contravention of a
provision of this Act may also require the data controller to rectify, block,
erase or destroy other data held by the data controller and which contains an
expression of opinion which appears to the Commission to be based on the
inaccurate data.
(4) Where
(a) an enforcement notice requires the data controller to rectify,
block, erase or destroy personal data, or
(b) the Commission is satisfied that personal data which has been
rectified, blocked, erased or destroyed was processed in contravention of
any of the data protection principles, the Commission may require the
data controller to notify a third party to
whom the data has been disclosed of the rectification, blocking, erasure
or destruction.
(5) An enforcement notice shall contain a statement of the data protection
principle which the Commission is satisfied has been contra- vened and the
reasons for that conclusion.
(6) Subject to this section, an enforcement notice shall not require any of
the provisions of the notice to be compiled with before the end of the period