(1) Subject to subsection (5), where a controller or processor carries out processing of personal data by automated means, the controller or processor, as the case may be, shall create and maintain a log (in this section referred to as a "data log") of the following processing operations carried out in automated processing systems in respect of that processing:
(a) the collection of personal data for the purposes of such processing and the alteration of any such data;
(b) the consultation of the personal data by any person;
(c) the disclosure of the personal data, including the transfer of the data, to any other person;
(d) the combination of the personal data with other data;
(e) the erasure of the personal data, or some of the data.
(2) Where a data log contains information specified in paragraph (b) or (c) of subsection (1), the controller or processor, as the case may be, shall ensure that the data log contains sufficient information to establish the following:
(a) the date and tim
…