PART 2 REQUESTS FOR ACCESS TO AND CORRECTION OF
PERSONAL DATA |
2. In this Part, unless the context otherwise requires —| “applicant” means an individual who makes a request; |
| “data protection officer”, in relation to an organisation, means an individual designated by the organisation under section 11(3) of the Act or an individual to whom the responsibility of the data protection officer has been delegated under section 11(4) of the Act; |
| “individual’s personal data” means personal data about an individual; |
| “request” means a request to an organisation made by an individual under section 21(1) or 22(1) of the Act; |
| “use and disclosure information” means the information specified in section 21(1)(b) of the Act. |
|
3.—(1) A request to an organisation must be made in writing and must include sufficient detail to enable the organisation, with a reasonable effort, to identify —| (a) | the applicant making the request; | | (b) | in relation to a request under section 21(1) of the Act, the personal data and use and disclosure information requested by the applicant; and | | (c) | in relation to a request under section 22(1) of the Act, the correction requested by the applicant. |
(2) A request must be sent to the organisation —| (a) | in accordance with section 48A of the Interpretation Act (Cap. 1); | | (b) | by sending the request to the organisation’s data protection officer in accordance with the business contact information provided under section 11(5) of the Act; or | | (c) | in any other manner that is acceptable to the organisation. |
|
|
| Duty to respond to request under section 21(1) of Act |
4.—(1) Subject to section 21(2), (3), (3A) and (4) of the Act and regulations 6 and 7(3), an organisation must respond to each request made to it under section 21(1) of the Act on or after 1 February 2021 as accurately and completely as necessary and reasonably possible.(2) The organisation must provide an applicant access to the applicant’s personal data requested under section 21(1) of the Act on or after 1 February 2021 —| (a) | by providing the applicant with a copy of the personal data and use and disclosure information in documentary form; | | (b) | if sub‑paragraph (a) is impracticable in any particular case, by allowing the applicant a reasonable opportunity to examine the personal data and use and disclosure information; or | | (c) | in any other form requested by the applicant as is acceptable to the organisation. |
|
|
| Notification of timeframe for response |
| 5. Subject to the requirement to comply with section 21(1) of the Act as soon as reasonably possible or section 22(2) of the Act as soon as practicable (as the case may be), if the organisation is unable to comply with that requirement within 30 days after receiving a request made in accordance with regulation 3, the organisation must within that time inform the applicant in writing of the time by which it will respond to the request. |
| Refusal to confirm or deny existence, use or disclosure of personal data |
6. Subject to section 21(4) of the Act, an organisation, in a response to a request made to it under section 21(1) of the Act, may refuse to confirm or may deny any of the following:| (a) | the existence of personal data mentioned in paragraph 1(h) of the Fifth Schedule to the Act as in force before, on or after 1 February 2021; | | (b) | the use or disclosure of personal data without consent under the following provisions for any investigation or proceedings, if the investigation or proceedings and related appeals have not been completed:| (i) | paragraph 3 of Part 3 of the First Schedule to the Act as in force on or after 1 February 2021; | | (ii) | paragraph 1(e) of the Third Schedule to the Act or paragraph 1(f) of the Fourth Schedule to the Act (as the case may be) as in force before 1 February 2021. |
|
|
7.—(1) Subject to section 28 of the Act as in force immediately before 1 February 2021 or section 48H of the Act (as the case may be), an organisation may charge an applicant who makes a request to it under section 21(1) of the Act a reasonable fee for services provided to the applicant to enable the organisation to respond to the applicant’s request.(2) An organisation must not charge a fee to respond to the applicant’s request under section 21(1) of the Act unless the organisation has —| (a) | provided the applicant with a written estimate of the fee; and | | (b) | if the organisation wishes to charge a fee that is higher than the written estimate provided under sub‑paragraph (a), notified the applicant in writing of the higher fee. |
|
(3) An organisation does not have to respond to an applicant’s request under section 21(1) of the Act unless the applicant agrees to pay the following fee:| (a) | where the organisation has notified the applicant of a higher fee under paragraph (2)(b) —| (i) | if the Commission —| (A) | has reviewed the higher fee under section 28(1) of the Act as in force immediately before 1 February 2021, the fee allowed by the Commission under section 28(2) of the Act as in force immediately before that date; or | | (B) | has reviewed the higher fee under section 48H(1) of the Act, the fee allowed by the Commission under section 48H(2) of the Act; or |
| | (ii) | if sub‑paragraph (i) does not apply, the higher fee notified under paragraph (2)(b); |
| | (b) | where sub‑paragraph (a) does not apply and the organisation has provided the applicant with an estimated fee under paragraph (2)(a) —| (i) | if the Commission —| (A) | has reviewed the estimated fee under section 28(1) of the Act as in force immediately before 1 February 2021, the fee allowed by the Commission under section 28(2) of the Act as in force immediately before that date; or | | (B) | has reviewed the estimated fee under section 48H(1) of the Act, the fee allowed by the Commission under section 48H(2) of the Act; or |
| | (ii) | if sub‑paragraph (i) does not apply, the estimated fee provided under paragraph (2)(a). |
|
|
| (4) To avoid doubt, an organisation must not charge the applicant any fee to comply with its obligations under section 22(2) of the Act. |
|
| Preservation of copies of personal data |
8.—(1) For the purposes of section 22A(1) of the Act, the prescribed period for the preservation of a copy of the personal data that an organisation has refused to provide is the period beginning immediately after the date of the organisation’s refusal and ending immediately after the relevant date.(2) In this regulation —| “date of refusal”, in relation to an organisation’s refusal, means the date on which the organisation notifies an individual of the organisation’s refusal; |
“date of withdrawal” —| (a) | in relation to an application made by a complainant under section 48H(1) of the Act in relation to an organisation’s refusal, means the date on which the complainant withdraws the application or the Commission dismisses the application under the Personal Data Protection (Enforcement) Regulations 2021 (G.N. No. S 62/2021); | | (b) | in relation to an application or appeal made by a complainant in relation to a decision or direction made by the Commission, means the date on which the complainant withdraws the application or appeal; or | | (c) | in relation to an application or appeal made by an organisation in relation to a decision or direction made by the Commission, means the date of compliance by the organisation with the decision or direction; |
|
| “organisation’s refusal” means an organisation’s refusal to provide, pursuant to an individual’s request under section 21(1)(a) of the Act, the individual’s personal data in the possession or under the control of the organisation; |
“relevant date”, in relation to an organisation’s refusal, means —| (a) | the 30th day after the date of refusal; or | | (b) | where, on or before the day mentioned in paragraph (a) or while the personal data concerned in relation to the organisation’s refusal is in the possession or under the control of the organisation on or after that date, the organisation has notice of any of the following applications or appeals — the latest of the following dates applicable to those applications or appeals:| (i) | an application to the Commission under section 48H(1)(a) of the Act to review the organisation’s refusal — the date of withdrawal of the application or the 28th day after the Commission issues its decision or direction made under section 48H(2) of the Act in relation to the application; | | (ii) | an application for reconsideration made to the Commission under section 48N(1) of the Act in relation to the organisation’s refusal — the date of withdrawal of the application or the 28th day after the date of issue of the Commission’s decision made under section 48N(6)(b) of the Act in relation to the application; | | (iii) | an application under section 48N(5) of the Act to extend the prescribed period for an application for reconsideration in relation to the organisation’s refusal — the date of withdrawal or refusal of the application or the date of expiry of the extended period allowed for the application, if any; | | (iv) | an appeal under section 48Q(1) of the Act against the Commission’s decision or direction made under section 48H(2) of the Act or decision made under section 48N(6)(b) of the Act (as the case may be) in relation to the organisation’s refusal — the date of withdrawal of the appeal or the 28th day after the Appeal Committee hearing the appeal issues its direction or decision; | | (v) | an appeal against, or with respect to, a direction or decision of the Appeal Committee mentioned in sub‑paragraph (iv) under section 48R of the Act — the date of withdrawal of the appeal or the date the General Division of the High Court or Court of Appeal (as the case may be) determines the appeal. |
|
|
|
|
|
