2D.—(1) Personal data shall not be treated, for the purposes of section 2(1)(a) of this Act, as processed fairly unless—

(a) in the case of data obtained from the data subject, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in subsection (2) of this section,

(b) in any other case, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in subsection (3) of this section—

(i) not later than the time when the data controller first processes the data, or

(ii) if disclosure of the data to a third party is envisaged, not later than the time of such disclosure.

(2) The information referred to in subsection (1)(a) of this section is:

(a) the identity of the data controller,

(b) if he or she has nominated a representative for the purposes of this Act, the identity of the representative,

(c) the purpose or purposes for which the data are intended to be processed, and

(d) any other information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data to be fair to the data subject such as information as to the recipients or categories of recipients of the data, as to whether replies to questions asked for the purpose of the collection of the data are obligatory, as to the possible consequences of failure to give such replies and as to the existence of the right of access to and the right to rectify the data concerning him or her.

(3) The information referred to in subsection (1)(b) of this section is:

(a) the information specified in subsection (2) of this section,

(b) the categories of data concerned, and

(c) the name of the original data controller.

(4) The said subsection (1)(b) does not apply—

(a) where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of the information specified therein proves impossible or would involve a disproportionate effort, or

(b) in any case where the processing of the information contained or to be contained in the data by the data controller is necessary for compliance with a legal obligation to which the data controller is subject other than an obligation imposed by contract,

if such conditions as may be specified in regulations made by the Minister after consultation with the Commissioner are complied with.]