(1) The Commissioner may investigate, or cause to be investigated, whether any provisions of this Act or the Regulations have been, are being or are likely to be contravened by a data controller in relation to a data subject if —
(a) the data subject complains to the Commissioner of a contravention of this Act; or
(b) the Commissioner is satisfied that there are reasonable grounds to investigate a matter under this Act.
(2) Where a complaint is made to the Commissioner under subsection (1), the Commissioner shall —
(a) investigate the complaint or cause it to be investigated by an authorized officer, unless he or she is of the opinion that it is frivolous or vexatious; and
(b) as soon as reasonably practicable, notify the data subject concerned in writing of his or her decision in relation to the complaint and that the data subject may, if aggrieved by the decision of the Commissioner appeal against the decision to the Court under section 69.
(3) This Act does not preclude the Commissioner from receiving and investigating complaints that are submitted by a person authorized in writing by the data subject concerned, to act on behalf of that data subject, and a reference to a data subject in any other section of this Act includes a reference to a person so authorized.