(b) (2) (3) (4) it is data that is subject to legal privilege or obtained in the course of an investigation or legal proceeding; (c) it is health or medical data where the data controller has a reasonable belief that providing access to the data could harm the health or safety of another person; or (d) it is evaluative or opinion material compiled solely for the purpose of determining suitability or eligibility for employment, the award of government contracts and other benefits where the disclosure would reveal the identity of a source who furnished data in circumstances where it may reasonably be assumed that the identity of the source would be held in confidence. The data controller may disregard requests from an individual for access to that individual’s personal data where it would unreasonably interfere with the operations of the data controller because of the repetitious and systematic nature of the requests, and the requests are frivolous or vexatious. With regard to sub-Article (1) lit. (b) of this Article denial shall be limited to the extent and for as long as access would pose a risk to an investigation or the proper conduct of a legal proceeding. The decision to refuse to disclose according to sub-Article (1) and (2) of this Article shall be communicated in a written form and has to give detail reasons for the denial. 37. Right to Rectification (1) Where a data subject believes that the personal data is inaccurate, incomplete, misleading, not-up-to-date, or is otherwise being processed contrary to the provisions of this Proclamation, the data subject shall have, on request, free of charge and without excessive delay, the right that the data controller corrects the data. (2) On correcting personal data under this provision, the data controller shall notify any other data controller or any third party to whom that data has been disclosed during the one year period before the correction was requested, of such correction. (3) Upon being notified under sub-Article (2) of this Article of a correction of personal data, the person shall make the correction on any record of that data in its custody or control. 38. (1) (2) Right to Erasure A data subject shall have, on request, free of charge and without excessive delay, the right to erasure of personal data where: (a) the data are no longer necessary in relation to the purpose for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing; (c) the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing; or (d) the personal data have been unlawfully processed. Where the data controller has made the personal data public, he shall take all reasonable steps to inform third parties processing such data, that the data subject has requested the erasure of any links to, or copy or replication of, that personal data. 18