! No. 18 Data Protection 26. A data subject has a right — 2019 Rights of a data subject. (a) to be informed of the use to which their personal data is to be put; (b) to access their personal data in custody of data controller or data processor; (c) to object to the processing of all or part of their personal data; (d) to correction of false or misleading data; and (e) to deletion of false or misleading data about them. 27. A right conferred on a data subject may be exercised— Exercise of rights of data subjects. (a) where the data subject is a minor, by a person who has parental authority or by a guardian; (b) where the data subject has a mental or other disability, by a person duly authorised to act as their guardian or administrator; or (c) in any other case, by a person duly authorised by the data subject. 28. (1) A data controller or data processor shall collect personal data directly from the data subject. (2) Despite sub-section (1), personal data may be collected indirectly where— (a) the data is contained in a public record; (b) the data subject has deliberately made the data public; (c) the data subject has consented to the collection from another source; (d) the data subject has an incapacity, the guardian appointed has consented to the collection from another source; (e) the collection from another source would not prejudice the interests of the data subject; (f) collection of data from another source is necessary— (i) for the prevention, detection, investigation, prosecution and punishment of crime; Collection of personal data.