(b) shall not, where the data are kept for direct marketing and other purposes, process the data for direct marketing after the expiry of 28 days. (4) The data controller shall notify the data subject in writing of any action taken under subsections (2) and (3) and, where appropriate, inform him of the other purposes for which the personal data is being processed. (5) Where a data controller fails to comply with a notice under subsection (1), the data subject may appeal to the Tribunal. (6) Where a data controller fails to comply with an order of the Tribunal, he shall commit an offence. 31. Transfer of personal data (1) Subject to subsection (2), no data controller shall, except with the written authorisation of the Commissioner, transfer personal data to another country. (2) The Eighth data protection principle specified in the First Schedule shall not apply where – (a) the data subject has given his consent to the transfer; (b) the transfer is necessary – (i) for the performance of a contract between the data subject and the data controller, or for the taking of steps at the request of the data subject with a view to his entering into a contract with the data controller; (ii) for the conclusion of a contract between the data controller and a person, other than the data subject, which is entered at the request of the data subject, or is in the interest of the data subject, or for the performance of such a contract;