7. Providing information where Personal Data have not been obtained from the Data Subject
(1) Where Personal Data have not been obtained from the Data Subject, a Data Controller or his representative shall at the time of undertaking the Processing of Personal Data or if a disclosure to a Third Party is envisaged, no later than the time when the Personal Data are first Processed or disclosed, provide the Data Subject with at least the following information —
(a) the identity of the Data Controller;
(b) the purposes of the Processing;
(c) any further information in so far as such further information is necessary, having regard to the specific circumstances in which the Personal Data are Processed, to guarantee fair Processing in respect of the Data Subject, such as —
(i) the categories of Personal Data concerned;
(ii) the Recipients or categories of Recipients;
(iii) the existence of the right of access to and the right to rectify the Personal Data concerning him;
(iv) whether the Personal Data will be used for direct marketing purposes; and
(v) whether the Personal Data will be Processed on the basis of section 3(1)(g) or section 5(k).
(2) Subsection (1) shall not apply to require —
(a) the Data Controller to provide information which the Data Controller reasonably expects the Data Subject to possess; or
(b) the provision of such information if it is reasonably impracticable or would involve a disproportionate effort.