[2003.] Data Protection (Amendment) Act 2003. [No. 6.] (b) The Commissioner and the Information Com- S.2 missioner shall, in the performance of their functions, co-operate with and provide assistance to each other.’’. 3.—Section 2 of the Principal Act is amended— (a) by the substitution of the following subsection for subsection (1): ‘‘(1) A data controller shall, as respects personal data kept by him or her, comply with the following provisions: (a) the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly, (b) the data shall be accurate and complete and, where necessary, kept up to date, (c) the data— (i) shall have been obtained only for one or more specified, explicit and legitimate purposes, (ii) shall not be further processed in a manner incompatible with that purpose or those purposes, (iii) shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they were collected or are further processed, and (iv) shall not be kept for longer than is necessary for that purpose or those purposes, (d) appropriate security measures shall be taken against unauthorised access to, or unauthorised alteration, disclosure or destruction of, the data, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.’’, (b) in subsection (5), by the substitution of the following paragraph for paragraph (a): ‘‘(a) Subparagraphs (ii) and (iv) of paragraph (c) of the said subsection (1) do not apply to personal data kept for statistical or research or other scientific purposes, and the keeping of which complies with such requirements (if any) as may be prescribed for the purpose of safeguarding the fundamental rights and freedoms of data subjects, and’’, (c) by the deletion of subsection (6), and (d) by the substitution of the following subsections for subsection (7): 9 Amendment of section 2 (collection, processing, keeping, use and disclosure of personal data) of Principal Act.