(Unofficial Translation)
No. 136 Chapter 69 Gor
Government Gazette
27 May 2019
(2) request to directly obtain the Personal Data in such formats that the Data
Controller sends or transfers to other Data Controllers, unless it is impossible to do so because
of the technical circumstances.
The Personal Data in paragraph one must be the Personal Data that the data
subject has given consent for the collection, use, or disclosure of such Personal Data according
to the rules under this Act, or the Personal Data that is exempted from consent requirements
under section 24 (3), or any other Personal Data referred to under section 24 as prescribed by
the Committee.
The exercise of rights of the data subject in paragraph one shall not apply to
the sending or transferring of Personal Data by the Data Controller which is the performance of
a task carried out in the public interest, or for compliance with law, or such exercise of rights
shall not violate the rights and freedoms of others. In the event that the Data Controller rejects
the request by such reasons, the Data Controller shall make a record of such rejection of the
request together with reasons in the record as prescribed in section 39.
Section 32
The data subject has the right to object the collection, use, or
disclosure of the Personal Data concerning him or her, at any time, in the following
circumstances:
(1) Where the Personal Data is collected with the exemption to consent
requirements under section 24 (4) or (5), unless the Data Controller can prove that:
(a) the collection, use, or disclosure of such Personal Data can be
demonstrated by the Data Controller that there is a compelling legitimate ground;
(b) the collection, use, or disclosure of such Personal Data is carried out
for the establishment, compliance or exercise of legal claims, or defense of legal claims;
(2) the collection, use, or disclosure of such Personal Data is for the purpose of
direct marketing;
(3) the collection, use, or disclosure of the Personal Data for the purpose of
scientific, historical or statistic research, unless it is necessary to performance of a task
carried out for reasons of public interest by the Data Controller.
In the event that the data subject exercises his or her right to object in paragraph
one, the Data Controller shall no longer be able to collect, use, or disclose such Personal Data,
and the Data Controller shall immediately distinguish such personal data clearly from the other
matters at the time when the data subject gives the notice of objection to the Data Controller.
In the event that the Data Controller rejects the objection by the reasons in (1)
(a) or (b) or (3), the Data Controller shall record such rejection of objection request together
with reasons in the record as prescribed in section 39.
Section 33
The data subject shall have the right to request the Data
Controller to erase or destroy the Personal Data, or anonymize the Personal Data to become the
anonymous data which cannot identify the data subject, where the following ground applies:
(1) the Personal Data is no longer necessary in relation to the purposes for
which it was collected, used or disclosed;
(2) the data subject withdraws consent on which the collection, use, or
disclosure is based on, and where the Data Controller has no legal ground for such collection,
14