Examination scripts 73. Personal data which consists of information recorded by candidates during an academic, professional or other examination is exempt from the provisions of this Act. Professional privilege 74. Personal data is exempt from the subject information provisions if it consists of information in respect of which a claim to professional privilege or confidentiality between client and a professional adviser could be maintained in legal proceedings. Enforcement Enforcement notice 75. (1) Where the Commission is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commission shall serve the data controller with an enforcement notice to require that data controller to do any of the following: (a) to take or refrain from taking the steps specified within the time stated in the notice, (b) to refrain from processing any personal data or personal data of a description specified in the notice; or (c) to refrain from processing personal data or personal data of a description specified in the notice for the purposes specified or in the manner specified after the time specified. (2) In deciding whether to serve an enforcement notice, the Com- mission shall consider whether the contravention has caused or is likely to cause damage or distress to any person. (3) An enforcement notice issued in respect of a contravention of a provision of this Act may also require the data controller to rectify, block, erase or destroy other data held by the data controller and which contains an expression of opinion which appears to the Commission to be based on the inaccurate data. (4) Where (a) an enforcement notice requires the data controller to rectify, block, erase or destroy personal data, or (b) the Commission is satisfied that personal data which has been rectified, blocked, erased or destroyed was processed in contravention of any of the data protection principles, the Commission may require the data controller to notify a third party to whom the data has been disclosed of the rectification, blocking, erasure or destruction. (5) An enforcement notice shall contain a statement of the data protection principle which the Commission is satisfied has been contra- vened and the reasons for that conclusion. (6) Subject to this section, an enforcement notice shall not require any of the provisions of the notice to be compiled with before the end of the period