32.
(1)
(2)
The Principle of Accountability
The data controller and, where applicable, the data processor, shall be responsible for
complying with all obligations set out in this Proclamation in respect of any processing
undertaken by him or on his behalf.
The data controller shall be able to demonstrate that any processing undertaken by it or
on its behalf is in accordance with the provisions of this Proclamation.
CHAPTER FOUR
RIGHTS OF DATA SUBJECTS
33.
(1)
(2)
(3)
(4)
Duration of Personal Data Protection
Privacy rights survive the death of the data subject.
For the execution of the provision of sub-Articles (1) of this Article, privacy rights shall
remain valid for ten years after the death of the data subject.
The lawful heir of the data subject may invoke the rights of the data subject at any time
within the ten years which follow the death of the data subject.
The consent of the lawful heir is not required if the processed personal data only contain
the data subject's name, sex, date of birth and death, the fact of death, and the time and
place of burial.
34. Right to be Informed
(1) Where personal data relating to a data subject are collected either from the data subject
or other sources, the data subject shall have the right to be provided by the data
controller with the following information:
(a) the name and contact details of the data controller;
(b) the name and contact details of the representative of the data controller;
(c) the contact details of the data protection officer of the data controller and his
representative;
(d) the purposes of the processing;
(e) whether providing answers to questions are voluntary or compulsory and the
possible consequences of failure to reply;
(f) the lawful basis for the processing;
(g) the recipients or categories of recipients of the personal data;
(h) the details of transfers of the personal data to a third party jurisdiction;
(i)
the retention periods for the personal data;
(j)
the rights available to data subjects in respect of the processing;
(k) the right to withdraw consent;
(l)
the right to lodge a complaint with a supervisory authority;
(m) the details of the existence of an automated decision-making, including profiling;
(n) the categories of personal data processed; and
16