6.—(1) An individual shall, if he so requests in writing a data controller who keeps personal data relating to him, be entitled to have rectified or, where appropriate, F24[blocked or] erased any such data in relation to which there has been a contravention by the data controller of section 2 (1) of this Act; and the data controller shall comply with the request as soon as may be and in any event not more than 40 days after it has been given or sent to him:

Provided that the data controller shall, as respects data that are inaccurate or not kept up to date, be deemed—

(a) to have complied with the request if he supplements the data with a statement (to the terms of which the individual has assented) relating to the matters dealt with by the data, and

(b) if he supplements the data as aforesaid, not to be in contravention of paragraph (b) of the said section 2 (1).

F25[(2) Where a data controller complies, or is deemed to have complied, with a request under subsection (1) of this section, he or she shall, as soon as may be and in any event not more than 40 days after the request has been given or sent to him or her, notify—

(a) the individual making the request, and

(b) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period of 12 months immediately before the giving or sending of the request unless such notification proves impossible or involves a disproportionate effort,]