Part IIINotification by data controllers
24Duty of certain data controllers to make certain information available
1
Subject to subsection (3), where personal data are processed in a case where—
a
by virtue of subsection (2) or (3) of section 17, subsection (1) of that section does not apply to the processing, and
b
the data controller has not notified the relevant particulars in respect of that processing under section 18,
the data controller must, within twenty-one days of receiving a written request from any person, make the relevant particulars available to that person in writing free of charge.
2
In this section “the relevant particulars” means the particulars referred to in paragraphs (a) to (f) of section 16(1).
3
This section has effect subject to any exemption conferred for the purposes of this section by notification regulations.
4
Any data controller who fails to comply with the duty imposed by subsection (1) is guilty of an offence.
5
It shall be a defence for a person charged with an offence under subsection (4) to show that he exercised all due diligence to comply with the duty.