(Unofficial Translation)
No. 136 Chapter 69 Gor
Government Gazette
27 May 2019
use, or disclosure;
(3) the data subject objects to the collection, use, or disclosure of the Personal
Data referred in Section 32 (1), and the Data Controller cannot reject to such request as referred
in section 32 (1) (a) or (b), or where the data subject exercise his or her right to object as referred
in section 32 (2);
(4) the Personal Data have been unlawfully collected, used, or disclosed under
this Chapter.
Paragraph one shall not apply to the extent that such Personal Data retention is
necessary for the purpose of freedom of expression, the purpose under section 24 (1) or (4) or
section 26(5) (a) or (b), the purpose of establishment, compliance or exercise of legal claims, or
defense of legal claims, or the purpose for compliance with the law.
Where the Data Controller has made the Personal Data disclose to public and
is requested to erase or destroy the Personal Data, or make the Personal Data become the
anonymous data which cannot identify the data subject pursuant to paragraph one, the Data
Controller shall be responsible for the course of action, both the implementation of technology
and the expenses to fulfil the request, and inform other Data Controllers in order to obtain their
responses regarding the action to be taken to fulfil such request.
In the event that the Data Controller does not take action in accordance with
paragraph one or three, the data subject shall have the right to complain to expert committee to
order the Data Controller to take such action.
The Committee may announce the rules for the erasure or destruction of
Personal Data, or anonymization of the Personal Data to become the anonymous data which
cannot identify the data subject pursuant to paragraph one.
Section 34
The data subject shall have the right to request the Data
Controller to restrict the use of the Personal Data, where the following applies:
(1) when the Data Controller is pending examination process in accordance
with the data subject's request pursuant to section 36;
(2) when it is the Personal Data which shall be erased or destroyed pursuant to
section 33 (4), but the data subject requests the restriction of the use of such Personal Data
instead;
(3) when it is no longer necessary to retain such Personal Data for the purposes
of such collection, but the data subject has necessity to request the retention for the purposes of
the establishment, compliance, or exercise of legal claims, or the defense of legal claims;
(4) when the Data Controller is pending verification with regard to section 32
(1), or pending examination with regard to section 32 (3) in order to reject the objection request
made by the data subject in accordance to section 32 paragraph three.
In the event that the Data Controller does not take action in accordance with
paragraph one, the data subject shall have the right to complain to expert committee to order the
Data Controller to take such action.
The Committee may prescribe and announce rules regarding the suspension of
use in accordance with paragraph one.
Section 35
The Data Controller shall ensure that the Personal Data remains
accurate, up-to-date, complete, and not misleading.
15