Amended by [Act No. 1 of 2009] 20. Referral to police On completion of an investigation under this Act, the Commissioner shall, where the investigation reveals that an offence has been committed under this Act or any regulations made under the Act, refer the matter to the Police. 21. Repealed by [Act No. 1 of 2009] PART IV – OBLIGATION ON DATA CONTROLLERS 22. Collection of personal data (1) Subject to Part VII, a data controller shall not collect personal data unless (a) it is collected for a lawful purpose connected with a function or activity of the data controller; and (b) (2) the collection of the data is necessary for that purpose. Where a data controller collects personal data directly from a data subject, the data controller shall at the time of collecting personal data ensure that the data subject concerned is informed of (a) the fact that the data is being collected; (b) the purpose or purposes for which the data is being collected; (c) the intended recipients of the data; (d) the name and address of the data controller; (e) whether or not the supply of the data by that data subject is voluntary or mandatory; (f) the consequences for that data subject if all or any part of the requested data is not provided;