[2003.] Data Protection (Amendment) Act 2003. [No. 6.] ‘‘(b) Where a data controller intends to keep per- S.17 sonal data for two or more related purposes, he or she shall make an application for registration in respect of those purposes and, subject to the provisions of this Act, entries shall be made in the register in accordance with any such application,’’, and (ii) by the insertion of the following paragraph after paragraph (b): ‘‘(c) Where a data controller intends to keep personal data for two or more unrelated purposes, he shall make an application for separate registration in respect of each of those purposes and, subject to the provisions of this Act, entries shall be made in the register in accordance with each such application.’’, and (b) by the substitution of the following subsection for subsection (3): ‘‘(3) The Commissioner shall not accept such an application for registration as aforesaid from a data controller who keeps sensitive personal data unless he or she is of opinion that appropriate safeguards for the protection of the privacy of the data subjects are being, and will continue to be, provided by him or her.’’. 18.—Section 18 of the Principal Act is amended by the substitution of the following subsection for subsection (2): ‘‘(2) The prescribed period (which shall not be less than one year) shall be calculated— Amendment of section 18 (duration and continuance of registration) of Principal Act. (a) in the case of a first registration from the date on which the relevant entry was made in the register, and (b) in the case of a registration which has been continued under this section, from the day following the expiration of the latest prescribed period.’’. 19.—Section 31 of the Principal Act is amended in subsection (1) by— (a) in paragraph (a), the substitution of ‘‘\3,000’’ for ‘‘£1,000’’, and Amendment of section 31 (penalties) of Principal Act. (b) in paragraph (b), the substitution of ‘‘\100,000’’ for ‘‘£50,000’’. 20.—The Second Schedule to the Principal Act is amended by the insertion of the following paragraph after paragraph 9: ‘‘10. (1) A person who holds or held the office of Commissioner or who is or was a member of the staff of the Commissioner shall not disclose to a person other than the Commissioner or such a member any information that is obtained by him or her in his capacity as Commissioner or as 35 Amendment of Second Schedule (the Data Protection Commissioner) to Principal Act.