Clause 10

by deleting the words “An organisation” in subsection (3) and substituting the words “Subject to subsection (3A), an organisation”;

by inserting, immediately after subsection (3), the following subsection:“(3A) Subsection (3)(c) and (d) does not apply to any user activity data about, or any user‑provided data from, the individual who made the request despite such data containing personal data about another individual.”;

by deleting subsection (4) and substituting the following subsection:“(4) An organisation must not inform any individual under subsection (1)(b) that the organisation has disclosed personal data about the individual to a prescribed law enforcement agency if the disclosure was made under this Act or any other written law without the consent of the individual.”; and

by inserting, immediately after subsection (5), the following subsections:“(6) Where —

an individual makes a request under subsection (1) to an organisation on or after the date of commencement of section 10 of the Personal Data Protection (Amendment) Act 2020; and

the organisation, by reason of subsection (2) or (3), does not provide an individual with the individual’s personal data or other information requested under subsection (1),the organisation must, within the prescribed time and in accordance with the prescribed requirements, notify the individual of the rejection.(7) Where —

an individual makes a request under subsection (1) to an organisation on or after the date of commencement of section 10 of the Personal Data Protection (Amendment) Act 2020; and

the organisation provides the individual, in accordance with subsection (5), with the individual’s personal data or other information requested under subsection (1),the organisation must notify the individual of the exclusion, under subsection (2) or (3), of any of the personal data or other information so requested.”.