Section 21 (1) The data subject is entitled to object to the control of their personal data a. should the personal data have to be controlled or transferred to fulfil the legal obligations of the controller, or validate the rightful interests of the controller, data recipient or third party except in the case of mandatory data control; b. should the personal data be used or transferred directly for business benefits, public opinion surveys or scientific research purposes, or c. other cases defined in relevant legislation. (2) The controller shall assess the objection lodged within the shortest possible space of time following the submission of the request; however, he or she shall assess the document within a maximum period of 15 days and make a decision on the grounds of the objection and notify the applicant of the decision in writing. (3) The controller shall suspend the control process – including data entry and data transfer – block the data and notify everyone to whom the personal data constituting the object of objection was transferred of the objection lodged, as well as measures taken on the grounds of this, which individuals are obliged to take measures to enforce the right to object, should the controller deem that the objection lodged is legitimate and justifiable. (4) The data subject is entitled to initiate legal proceedings – in accordance with the mode specified in Section 22 - within a period of 30 days following the announcement of the decision or the final day of the deadline period, should the data subject disagree with the decision made by the controller on the grounds of subsection (2), or should the controller fail to observe the deadline set in subsection (2). (5) The data subject is entitled to initiate legal proceedings – in accordance with the mode specified in Section 22 - within a period of 15 days following the announcement of the decision pursuant to subsection (2), should the data required to assert the rights of the data recipient not have been received because of the objection lodged by the data subject. The controller is authorised to summon the data subject to court. (6) The data recipient is entitled to request information on the circumstances causing data transfer problems from the controller, should the controller fail to send the notification specified in subsection (3), which information the controller is obliged to provide for the data recipient within a period of eight days following the sending of the request submitted in this matter. Should information be requested, the data recipient is entitled to turn to the courts and initiate proceedings against the controller after the information is provided, however, no later than within 15 days following the deadline date specified in this regard. The controller is authorised to summon the data subject to court. (7) The controller is not authorised to delete the data of the data subject if the control of the data was ordered by law. However, the data of the subject data cannot be transferred to the data recipient if the controller agreed with the objection made, or the court deems that the objection is legally justified. 16. Assertion of Rights in Court Section 22 (1) The controller is entitled to initiate legal proceedings against the data recipient should the rights of the data subject be infringed, as well as in cases listed under Section 21. The courts shall take immediate action in such cases. (2) The controller shall be obliged to prove that the data has been controlled in compliance with the relevant legislation. The data recipient shall be obliged to prove the legitimacy of the data transfer in respect of the data transferred to this party in cases listed in Section 21 (5) and (6).