312 The Data Protection Bill, 2018 "data controller" means a person who, either alone or together with other persons, controls the contents and use of personal information; "data subject" means a person from whom personal data is obtained; "disclosure", in relation to personal information, includes the disclosure of information extracted from such data and the transfer of such data but does not include a disclosure made directly or indirectly by a data controller or a data processor to an employee or agent of his for the purpose of enabling the employee or agent to carry out his duties and, where the identification of a data subject depends partly on the data and partly on other information in the possession of the data controller, the data shall not be considered as disclosed unless the other information is also disclosed; "exempt information" means information that may be withheld by a public entity or a private body in accordance with section 6 of the Access to Information Act; No.31 of 2016. "person" has the meaning assigned to it under Article 260 of the Constitution; "personal data" means information about a person, includinginformation relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language and birth of the individual; information relating to the education, medical, criminal or employment history of the person or information relating to financial transactions in which the person has been involved in; an identif\jing number, symbol or other particular assigned to the individual; the fingerprints or blood type of the person; contact details including telephone numbers of the person; correspondence by a person that is implicitly or explicitly of a private or confidential nature or No. 14 of 2011.