9 Data Protection Act, 2018 - 5. ............................................... (2) An application under subsection (1) shall– (a) be in writing; and (b) as far as practicable, specify– (i) the document containing the record of personal data that is claimed to require the amendment; (ii) the personal data that is claimed to be incomplete, incorrect, misleading or irrelevant; (iii) the reasons for the claim; and (iv) the amendment requested by the data subject. (3) To the extent that it is practicable to do so, the public body or private body shall, when making an amendment to personal data in a document pursuant to this section, ensure that it does not obliterate the text of the document as it existed prior to the amendment. (4) Where a public body or a private body is not satisfied with the reasons for an application pursuant to subsection (1), it may refuse to make an amendment to the personal data and inform the data subject of its refusal and the reasons for the refusal and inform the data subject that they may lodge a complaint in writing to the Information Commissioner. (5) A data subject who is aggrieved by a decision of a public body or a private body pursuant to subsection (4) may lodge a complaint in writing to the Information Commissioner within twenty–eight days of the date of the receipt of the communication of refusal. 19. Extent of disclosure of personal data. Notwithstanding section 9, personal data of a data subject may be disclosed by a data user for any purpose other than the purpose for which the personal data was to be disclosed at the time of its collection or any other purpose directly related to that purpose, only under the following circumstances– (a) the data subject has given his or her consent to the disclosure; (b) the disclosure – (i) is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations; or (ii) was required or authorised by or under any law or by the order of a court; (c) the data user acted in the reasonable belief that he or she had in law the right to disclose the personal data to the other person; (d) the data user acted in the reasonable belief that he or she would have had the consent of the data subject if the data subject had known of the disclosing of the personal data and the circumstances of such disclosure; or (e) the disclosure was justified as being in the public interest in circumstances as determined by the Minister. 20. Processing of sensitive personal data. (1) Subject to subsection (2) and Part II, a data user shall not process any sensitive