No. 136 Chapter 69 Gor Government Gazette 27 May 2019 (2) the data subject withdraws consent on which the collection, use, or disclosure is based on, and where the Data Controller has no legal ground for such collection, use, or disclosure; (3) the data subject objects to the collection, use, or disclosure of the Personal Data referred in Section 32(1), and the Data Controller can not reject to such request as referred in Section 32(1) (a) or (b), or where the data subject exercise his or her right to object as referred in Section 32(2); or (4) the Personal Data have been unlawfully collected, used, or disclosed under this Chapter. Paragraph one shall not apply to the extent that such Personal Data retention is necessary for the purpose of freedom of expression, the purpose under Section 24(1) or (4) or Section 26(5)(a) or (b), the purpose of establishment, compliance or exercise of legal claims, or defense of legal claims, or the purpose for compliance with the law. Where the Data Controller has made the Personal Data public and is requested to erase or destroy the Personal Data, or make the Personal Data become the anonymous data which can not identify the data subject pursuant to paragraph one, the Data Controller shall be responsible for the course of action, both the implementation of technology and the expenses to fulfil the request, and inform other Data Controllers in order to obtain their responses regarding the action to be taken to fulfil such request. In the event that the Data Controller does not take action in accordance with paragraph one or three, the data subject shall have the right to complain to expert committee to order the Data Controller to take such action. The Committee may announce the rules for the erasure or destruction of Personal Data, or anonymization of the Personal Data to become the anonymous data which can not identify the data subject pursuant to paragraph one. Section 34 The data subject shall have the right to request the Data Controller to restrict the use of the Personal Data, where the following applies: (1) when the Data Controller is pending examination process in accordance with the data subject's request pursuant to Section 36; (2) when it is the Personal Data which shall be erased or destroyed pursuant to Section 33 (4), but the data subject requests the restriction of the use of such Personal Data instead. (3) when it is no longer necessary to retain such Personal Data for the purposes of such collection, but the data subject has necessity to request for further retention for the purposes of the establishment, compliance or exercise of legal claims, or defense of legal claims; (4) when the Data Controller is pending verification with regard to Section 32 (1), or pending examination with regard to Section 32 (3) in order to reject the objection request made by the data subject in accordance to Section 32 paragraph three. In the event that the Data Controller does not take action in accordance with paragraph one, the data subject shall have the right to complain to expert committee to order the Data Controller to take such action. 17