93. (1) Where a controller—

(a) provides or makes available information to a data subject under section 90,

(b) provides or makes available information to, or communicates with, a data subject pursuant to a request under section 91 or 92,

the controller shall take all reasonable steps to ensure the information is provided or made available, or the communication is made, as the case may be, in a concise, intelligible and easily accessible form using clear and plain language.

(2) The information or communication, as the case may be, referred to in subsection (1), shall—

(a) be provided to the data subject by appropriate means, including by electronic means, and

(b) in the case of a communication with a data subject pursuant to a request under section 91 or 92, in so far as is possible, be provided in the same form as that in which the request is made.

(3) A controller shall not impose a charge on a data subject for information provided to him or her under section 90 or, subject to subsection (4)(i), pursuant to a request under section 91 or 92.

(4) Where a data subject makes a request to a controller under section 91 or 92 that is—

(a) manifestly unfounded, or

(b) excessive in nature, having regard to the number of requests made by the data subject to the controller under those sections,

the controller may—

(i) charge a reasonable fee to the data subject in respect of the request, having regard to the administrative cost to the controller of complying with the request, or

(ii) refuse to act upon the request.

(5) Where a controller, pursuant to subsection (4)(ii), refuses to act upon a request under section 91 or 92 it shall, as soon as practicable, so notify the data subject in writing.

(6) A notification under subsection (5) shall include—

(a) the reasons for which the controller is refusing to act upon the request under section 91 or 92, as the case may be, pursuant to subsection (4)(ii), and

(b) information relating to the right of the data subject under Chapter 3 of Part 6 to lodge a complaint with the Commission and the contact details of the Commission.

(7) Where, pursuant to subsection (4)(ii), a controller refuses to act upon a request made to the controller by a data subject under section 91 or 92, it shall be for the controller to demonstrate that the request was manifestly unfounded or excessive in nature.

(8) In this section, a reference to a “data subject” shall be construed as including an individual who makes a request under section 91(1), irrespective of whether the controller is processing personal data relating to the individual.