(1) A data controller shall not comply with a request under section 52 where —
(a) he or she is being requested to disclose information given or to be given in confidence for the purposes of—
(i) the education, training or employment, or prospective education, training or employment, of the data subject,
(ii) the appointment, or prospective appointment, of the data subject to any office, or
(iii) the provision, or prospective provision, by the data subject of any service;
(b) the personal data requested consist of information recorded by candidates during an academic, professional or other examination;
(c) such compliance would, by revealing evidence of the commission of any offence other than an offence under this Act, expose him or her to proceedings for that offence.
(2) The data controller shall notify the data subject or relevant person, in writing, of a refusal of a request made by a data subject or relevant person and shall include a statement of the reasons for the refusal and an indication that the data subject or relevant person may complain to the Commissioner about the refusal.