In section 7 of the M1Data Protection Act 1998 (right of access to personal data), for subsection (3) there is substituted—

“(3)

Where a data controller—

(a)

reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and

(b)

has informed him of that requirement,

the data controller is not obliged to comply with the request unless he is supplied with that further information.”