5The purpose or purposes for which personal data are obtained may in particular be specified—
(a)in a notice given for the purposes of paragraph 2 by the data controller to the data subject, or
(b)in a notification given to the Commissioner under Part III of this Act.