90. (1) Subject to subsection (4) and section 94, a controller shall ensure that the data subject is provided with, or, as appropriate, has made available to him or her, the information specified in subsection (2) in relation to personal data relating to him or her within a reasonable period after the date on which the controller obtains the personal data concerned, having regard to the circumstances in which the data are or are to be processed.

(2) The information to which subsection (1) applies is:

(a) the identity and the contact details of the controller;

(b) the contact details of the data protection officer of the controller, where applicable;

(c) the purpose for which the personal data are intended to be processed or are being processed;

(d) information detailing the right of the data subject to request from the controller access to, and the rectification or erasure of, the personal data;

(e) information detailing the right of the data subject to lodge a complaint with the Commission and the contact details of the Commission;

(f) in individual cases where further information is necessary to enable the data subject to exercise his or her rights under this Part, having regard to the circumstances in which the personal data are or are to be processed, including the manner in which the data are or have been collected, any such information including:

(i) the legal basis for the processing of the data concerned, including the legal basis for any transfers of data;

(ii) the period for which the data concerned will be retained, or where it is not possible to determine the said period at the time of the giving of the information, the criteria used to determine the said period;

(iii) where applicable, each category of recipients of the data.

(3) The information referred to in paragraphs (a) to (e) of subsection (2) may be made available to the data subject by means of publication on the website of the controller.

(4) Without prejudice to section 94, subsection (1) shall not apply to information specified in subsection (2)—

(a) where the information is already in the possession of the data subject, or

(b) where, in particular in the case of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the provision of the information proves impossible or would involve a disproportionate effort.