Regulation 16 Internal procedures where the scope of rights and obligations are restricted and damages for contravention of Regulations
(a) Where a legislative measure has been adopted in accordance with Article 15(1) of the Directive on privacy and electronic communications which restricts the scope of the rights and obligations provided for under Regulations 5, 6, 8(1), 8(2) and 9, providers shall establish internal procedures for responding to requests for access to users' personal data having regard to the legislative measures adopted.
(b) The provider shall, when requested to do so by the Commissioner, provide the Commissioner with information about the internal procedures referred to in subparagraph (a), the number of requests received, the legal justification invoked and the provider's response to the requests.
(c) The Commissioner may seek the information referred to in subparagraph (b) in writing and the provider shall supply the information sought in writing within 28 days of receipt of the request.
(d) A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in a request for information under subparagraph (b) or in purported compliance with such a requirement gives information to the Commissioner that the person knows to be false or misleading in a material respect commits an offence.