116 No. 3 of 2021] Data Protection (2) An agreement entered into under subsection (1) shall be made available to the data subject. (3) Joint data controllers shall be jointly and severally liable to the data subject. Offence by data controller 55. (1) A body corporate that contravenes the provisions of this part commits an offence and is liable, on conviction, to two percent of annual turnover of the preceding financial year or to two million penalty units, whichever is higher. (2) Where an offence under subsection (1) is committed by a natural person, that person shall be liable, on conviction, to a fine not exceeding one million penalty units or to imprisonment for a term not exceeding ten years, or to both. Personal data in legal proceedings 56. A person shall not process personal data in legal proceedings, except— (a) under the supervision of a public body discharging its duty if the processing is necessary for those legal proceedings; (b) where the processing is necessitated by litigation; or (c) by a legal practitioner to the extent that the processing is necessary for the protection of the legal practitioner’s clients’ interests. Notification 57. A data controller or data processor shall notify the Data Protection Commissioner of any third party agreement that allows the third party to trade on the profile of a data subject. PART IX RIGHTS OF THE DATA SUBJECT Right of access and notification 58. (1) A data subject has the right to obtain from the data controller, confirmation as to whether or not personal data concerning that data subject is being processed. (2) A data subject may, where that data subject’s personal data is being processed, access in a manner that the data subject understands the following information: (a) the purpose of the processing, the category of data the processing relates to, and the categories of recipients the data is disclosed to; (b) envisaged period for which the personal data shall be stored, where possible or if not possible, the criteria used to determine that period;