12A.—(1) This section applies to any processing that is of a prescribed description, being processing that appears to the Commissioner to be particularly likely—

(a) to cause substantial damage or substantial distress to data subjects, or

(b) otherwise significantly to prejudice the rights and freedoms of data subjects.

(2) The Commissioner, on receiving—

(a) an application under section 17 of this Act by a person to whom section 16 of this Act applies for registration in the register and any prescribed information and any other information that he or she may require, or

(b) a request from a data controller in that behalf,

shall consider and determine—

(i) whether any of the processing to which the application or request relates is processing to which this section applies,

(ii) if it does, whether the processing to which this section applies is likely to comply with the provisions of this Act.

(3) Subject to subsection (4) of this section, the Commissioner shall, within the period of 90 days from the day on which he or she receives an application or a request referred to in subsection (2) of this section, serve a notice on the data controller concerned stating the extent to which, in the opinion of the Commissioner, the proposed processing is likely or unlikely to comply with the provisions of this Act.

(4) Before the end of the period referred to in subsection (3), the Commissioner may, by reason of special circumstances, extend that period once only, by notice in writing served on the data controller concerned, by such further period not exceeding 90 days as the Commissioner may specify in the notice.

(5) If, for the purposes of his or her functions under this section, the Commissioner serves an information notice on the data controller concerned before the end of the period referred to in subsection (3) of this section or that period as extended under subsection (4) of this section—

(a) the period from the date of service of the notice to the date of compliance with the requirement in the notice, or

(b) if the requirement is set aside under section 26 of this Act, the period from the date of such service to the date of such setting aside,

shall be added to the period referred to in the said subsection (3) or that period as so extended as aforesaid.

(6) Processing to which this section applies shall not be carried on unless—

(a) the data controller has—

(i) previously made an application under section 17 of this Act and furnished the information specified in that section to the Commissioner, or

(ii) made a request under subsection (2) of this section,

and

(b) the data controller has complied with any information notice served on him or her in relation to the matter, and

(c)(i) the period of 90 days from the date of the receipt of the application or request referred to in subsection (3) of this section (or that period as extended under subsections (4) and (5) of this section or either of them) has elapsed without the receipt by the data controller of a notice under the said subsection (3), or

(ii) the data controller has received a notice under the said subsection (3) stating that the particular processing proposed to be carried on is likely to comply with the provisions of this Act, or

(iii) the data controller—

(I) has received a notice under the said subsection (3) stating that, if the requirements specified by the Commissioner (which he or she is hereby authorised to specify) and appended to the notice are complied with by the data controller, the processing proposed to be carried on is likely to comply with the provisions of this Act, and

(II) has complied with those requirements.

(7) A person who contravenes subsection (6) of this section shall be guilty of an offence.

(8) An appeal against a notice under subsection (3) of this section or a requirement appended to the notice may be made to and heard and determined by the Court under section 26 of this Act and that section shall apply as if such a notice and such a requirement were specified in subsection (1) of the said section 26.

(9) The Minister, after consultation with the Commissioner, may by regulations amend subsections (3), (4) and (6) of this section by substituting for the number of days for the time being specified therein a different number specified in the regulations.

(10) A data controller shall pay to the Commissioner such fee (if any) as may be prescribed in respect of the consideration by the Commissioner, in relation to proposed processing by the data controller, of the matters referred to in paragraphs (i) and (ii) of subsection (2) of this section and different fees may be prescribed in relation to different categories of processing.

(11) In this section a reference to a data controller includes a reference to a data processor.]