11.—(1) Subject to subsection (3), on any of the grounds set out in prevent subsection (2) an individual is entitled at any time, by notice in writing to the data controller, to require the data controller—
(a) within a period which is reasonable in the circumstances, to cease; or
(b) not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which the individual is the data subject.
(2) The grounds referred to in subsection (1) are that, for reasons which shall be specified in the notice under subsection (1}—
(a) the processing of the personal data, or the processing of the personal data for that purpose or in that manner, is causing
oris likely to cause, substantial damage or substantial distress to the data subject or to another, and that the damage or distress caused or likely to be caused (as the case may be) is unwarranted;
(b) the personal data is incomplete, or irrelevant, having regard . to the purpose of the processing;
(c) the processing of the personal data, or the processing of the . personal data for that purpose or in that manner, is prohibited under any law; or
(d) the personal data has been retained by the data controller for-longer than the period of time for which it may be retained by the data controller under any law.
(3) Subsection (1) does not apply—
(a) inacase where any of the conditions set out in section 23(1) is met; or
(b) insuch other cases as the Minister may specify by order in accordance with section 74(3)(b).
(4) Adata controller who receives a notice under subsection
(1) shall, within twenty-one days after receiving the notice, give the individual who gave the notice a written statement—
(a) that the data controller has complied or intends to comply with the notice; or
(b) ofthe data controller’s reasons for regarding the notice as, to any extent, unjustified and the extent (if any) to which the data controller has complied or intends to comply with the notice.
(5) Ifthe Commissioner is satisfied, on the written application of any individual who has given a notice under subsection (1) which appears to the Commissioner to be justified, or to be justified to any
. extent, that the data controller in question has failed to comply with the notice, the Commissioner may order the data controller to take such steps for complying with the notice (or complying with the notice to such extent) as the Commissioner thinks fit.
(6) The failure by a data subject to exercise the rights conferred
on that individual by subsection (1) or section 12(2) shall not be
construed as affecting any other right conferred on the data subject by
this Part. Rights in