[2003.] Data Protection (Amendment) Act 2003. [No. 6.] to those imposed on the data control- S.4 ler by section 2(1)(d) of this Act, (b) ensure that the data processor provides sufficient guarantees in respect of the technical security measures, and organisational measures, governing the processing, and (c) take reasonable steps to ensure compliance with those measures. Fair processing of personal data. 2D.—(1) Personal data shall not be treated, for the purposes of section 2(1)(a) of this Act, as processed fairly unless— (a) in the case of data obtained from the data subject, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in subsection (2) of this section, (b) in any other case, the data controller ensures, so far as practicable, that the data subject has, is provided with, or has made readily available to him or her, at least the information specified in subsection (3) of this section— (i) not later than the time when the data controller first processes the data, or (ii) if disclosure of the data to a third party is envisaged, not later than the time of such disclosure. (2) The information referred to in subsection (1)(a) of this section is: (a) the identity of the data controller, (b) if he or she has nominated a representative for the purposes of this Act, the identity of the representative, (c) the purpose or purposes for which the data are intended to be processed, and (d) any other information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data to be fair to the data subject such as information as to the recipients or categories of recipients of the data, as to whether replies to questions asked for the purpose of the collection of the data are obligatory, as to the possible 17