Personal Data Protection Act, No. 9 of 2022 23 (a) goods or services of a controller or any third party; or (b) any person, entity or organisation including the controller, using postal, electronic or telecommunication services or any other similar methods, including the use of automated calling and communication systems with or without human intervention, other than any internet based advertisements to which a data subject has consented to obtain a service, free of charge from the controller. PART V DATA PROTECTION AUTHORITY 28. (1) There shall be established an authority which shall be called the Data Protection Authority of Sri Lanka (in this Act referred to as the “Authority”) for the purposes of this Act. Establishment of the data Protection Authority (2) The Authority shall, by the name assigned to it by subsection (1), be a body corporate and shall have perpetual succession and a common seal and may sue and be sued in such name. 29. (1) The administration, management and control of the affairs of the Authority shall be vested in a Board of Directors (in this Act referred to as the “Board”). (2) The Board shall, for the purpose of administering the affairs of the Authority, exercise, perform and discharge the powers, duties and functions conferred on, assigned to or imposed on, the Authority by this Act. (3) The Board shall consist of not less than five members and not more than seven members appointed by the President from among persons who have reached eminence and proven Constitution of the Board of Directors