[2003.] Data Protection (Amendment) Act 2003. [No. 6.] (II) to supply him or her with data relating to S.5 that other person obtained as a result of such a request. (b) A person who contravenes paragraph (a) of this subsection shall be guilty of an offence.’’. 6.—Section 5 of the Principal Act is amended by the insertion in subsection (1) before paragraph (h) of the following paragraph: ‘‘(gg) kept by the Commissioner or the Information Commissioner for the purposes of his or her functions,’’. 7.—Section 6 of the Principal Act is amended— (a) in subsection (1), by the insertion after ‘‘where appropriate,’’ of ‘‘blocked or’’, and Amendment of section 5 (restriction of right of access) of Principal Act. Amendment of section 6 (right of rectification or erasure) of Principal Act. (b) by the substitution of the following subsection for subsection (2): ‘‘(2) Where a data controller complies, or is deemed to have complied, with a request under subsection (1) of this section, he or she shall, as soon as may be and in any event not more than 40 days after the request has been given or sent to him or her, notify— (a) the individual making the request, and (b) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period of 12 months immediately before the giving or sending of the request unless such notification proves impossible or involves a disproportionate effort, of the rectification, blocking, erasure or statement concerned.’’. 8.—The following sections are inserted in the Principal Act after section 6: ‘‘Right of data subject to object to processing likely to cause damage or distress. 6A.—(1) Subject to subsection (3) and unless otherwise provided by any enactment, an individual is entitled at any time, by notice in writing served on a data controller, to request him or her to cease within a reasonable time, or not to begin, processing or processing for a specified purpose or in a specified manner any personal data in respect of which he or she is the data subject if the processing falls within subsection (2) of this section on the ground that, for specified reasons— (a) the processing of those data or their processing for that purpose or in that manner is causing or likely to cause substantial damage or distress to him or her or to another person, and 21 Certain rights of data subjects.