(5) The controller tags the personal data they control should the data subject dispute its correctness or accuracy, yet it is not possible to explicitly verify the incorrectness or inaccuracy of the disputed personal data. Section 18 (1) The data subject, as well as everyone to whom the data was transferred for control purposes, must be notified of any correction, blocking and deletion. Exemptions apply should this not violate the rightful interest of the data subject in respect of the objective of control. (2) Should the controller fail to fulfil the request of the data subject regarding correction, blocking or deletion, the controller shall provide the reasons and legal grounds for rejecting the request submitted in connection with correction, blocking or deletion within a period of 30 days following the receipt of the request. Should the request for correction, blocking or deletion be rejected, the controller shall notify the data subject of the opportunities available to seek legal redress via the courts and on the help available from the Authority. Section 19 Rights defined for the data subject under Sections 14–18 may be restricted by law for reasons pertaining to domestic and external national security, and therefore, to national defence, to ensure national security, prevent or prosecute offences, ensure the security of penal institutions, as well as the economic and financial interests of the state or local governments; to disciplinary and ethical offenses, prevent and expose labour law related and occupational safety infringements – including control and supervision in every case – in addition to protecting the rights of the data subject or others. 14. The Requirement to Preliminarily Inform the Data subject Section 20 (1) Prior to control being initiated the data subject must be informed of whether the control is to be conducted on the grounds of consent or is mandatory. (2) Prior to control being initiated the data subject must be explicitly informed in detail of every fact relating to the control of their data, and therefore in particular, of the objective of the control and its legal grounds, the individual authorised to control and process the data, the duration of the control process, should the controller be controlling the personal data of the data subject in accordance with Section 6 (5), as well as of who is authorised to acquire knowledge of this data. This information must equally detail the rights and legal redress opportunities the data subject has in connection with control. (3) In the case of mandatory control, information may also be provided by publically referring to legislative provisions specifying information set out in subsection (2). (4) Should it not possible to personally inform the data subject or the cost of this proves excessively high, information may also be provided by disclosing the following information: a. b. c. d. e. f. the event of the data collection, scope concerned, purpose of the data collection, duration of the control, possible controllers authorised to acquire knowledge of the data, providing information on the rights and legal redress opportunities in connection with the control of the data pertaining to the data subjects, and g. control registration number, except in the case specified in Section 68 (2), should the control be subject to data protection registration. 15. Objection to the Control of Personal Data