[No. 6.] S.3 Data Protection (Amendment) Act 2003. [2003.] ‘‘(7) Where— (a) personal data are kept for the purpose of direct marketing, and (b) the data subject concerned requests the data controller in writing— (i) not to process the data for that purpose, or (ii) to cease processing the data for that purpose, then— (I) if the request is under paragraph (b)(i) of this subsection, the data controller— (A) shall, where the data are kept only for the purpose aforesaid, as soon as may be and in any event not more than 40 days after the request has been given or sent to him or her, erase the data, and (B) shall not, where the data are kept for that purpose and other purposes, process the data for that purpose after the expiration of the period aforesaid, (II) if the request is under paragraph (b)(ii) of this subsection, as soon as may be and in any event not more than 40 days after the request has been given or sent to the data controller, he or she— (A) shall, where the data are kept only for the purpose aforesaid, erase the data, and (B) shall, where the data are kept for that purpose and other purposes, cease processing the data for that purpose, and (III) the data controller shall notify the data subject in writing accordingly and, where appropriate, inform him or her of those other purposes. (8) Where a data controller anticipates that personal data, including personal data that is required by law to be made available to the public, kept by him or her will be processed for the purposes of direct marketing, the data controller shall inform the persons to whom the data relates that they may object, by means of a request in 10