No. 136 Chapter 69 Gor
Government Gazette
27 May 2019
(2) request to directly obtain the Personal Data in such formats that the Data
Controller sends or transfers to other Data Controllers, unless it is impossible to do so because
of the technical circumstances.
The Personal Data in paragraph one must be the Personal Data that the data
subject has given consent for the collection, use, or disclosure of such Personal Data
according to the rules under this Act, or the Personal Data that is exempted from consent
requirements under Section 24(3), or any other Personal Data referred to under Section 24 as
prescribed by the Committee.
The exercise of rights of the data subject in paragraph one shall not apply to
the sending or transferring of Personal Data by the Data Controller which is the
performance of a task carried out in the public interest, or for compliance with law, or such
exercise of rights shall not violate the rights and freedoms of others. In the event that the Data
Controller rejects the request by such reasons, the Data Controller shall make a record of such
rejection of the request together with reasons in the record as prescribed in Section 39.
Section 32 The data subject has t h e right to object the collection, use,
or disclosure of the Personal Data concerning him or her, at any time, in the following
circumstances:
(1) Where the Personal Data i s collected with the exemption to consent
r e q u i r e m e n t s under Section 24(4) or (5), unless the Data Controller can prove that:
(a) the collection, use, or disclosure of such Personal Data can be
demonstrated by the Data Controller that there is a compelling legitimate ground;
(b) the collection, use, or disclosure of such Personal Data is carr ied
out for the establishment, compliance or exercise of legal claims, or defense of legal claims;
(2) the collection, use, or disclosure of such Personal Data i s for the
purpose of direct marketing; or
(3) the collection, use, or disclosure of the Personal Data for the purpose of
scientific, historical or statistic research, unless it is necessary to performance of a task
carried out for reasons of public interest by the Data Controller.
In the event that the data subject exercises his or her right to object in
paragraph one, the Data Controller shall no longer be able to collect, use, or disclose such
Personal Data. And the Data Controller shall immediately distinguish such personal data
clearly from the other matters at the time when the data subject gives the notice of
objection to the Data Controller.
In the event that the Data Controller rejects the objection by the reasons in
(1) (a) or (b) or (3), the Data Controller shall record such rejection of objection request
together with reasons in the record as prescribed in Section 39.
Section 33 The data subject shall have the right to request the Data Controller
to erase or destroy the Personal Data, or anonymize the Personal Data to become the
anonymous data which can not identify the data subject, where the following ground applies:
(1) the Personal Data is no longer necessary in relation to the purposes for
which it was collected, used or disclosed;
16
Select target paragraph3
Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents