protect a data subject who is affected by the unauthorised access or acquisition of data, the Commission may direct the data controller to publicise in the specified manner, the fact of the compromise to the integrity or confidentiality of the personal data. Access to personal information 32. (1) A data subject who provides proof of identity may request a data controller to (a) confirm at reasonable cost to the data subject whether or not the data controller holds personal data about that data subject, (b) give a description of the personal data which is held by the party including data about the identity of a third party or a category of a third party who has or has had access to the information, and (c) correct data held on the data subject by the data controller. (2) The request shall be made (a) within a reasonable time; (b) after the payment of the prescribed fee, if any; (c) in a reasonable manner and format; and (d) in a form that is generally understandable. Correction of personal data 33. (1) A data subject may request a data controller to (a) correct or delete personal data about the data subject held by or under the control of the data controller that is inac- curate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or (b) destroy or delete a record of personal data about the data subject held by the data controller that the data controller no longer has the authorisation to retain. (2) On receipt of the request, the data controller shall comply with the request or provide the data subject with credible evidence in support of the data. (3) Where the data controller and the data subject are unable to reach an agreement and if the data subject makes a request, the data con- troller shall attach to the record an indication that a request for the data has been made but has not been complied with. (4) Where the data controller complies with the request, the data controller shall inform each person to whom the personal data has been disclosed of the correction made. (5) The data controller shall notify the data subject of the action taken as a result of the request. Manner of access 34. The provisions of any legislation relating to the right to information of any data subject shall be additional to data subject rights under this Act.