(2) Without prejudice to the generality of subsection (1), where personal data to which the data correction request relates is an expression of opinion and the data controller is not satisfied that the expression of opinion is inaccurate, incomplete, misleading or not up-to-date, the data controller shall— (a) make a note, whether annexed to the personal data or elsewhere— (i) of the matters in respect of which the expression of opinion is considered by the requestor to be inaccurate, incomplete, misleading or not up-to-date; and (ii) in such a way that the personal data cannot be used by any person without the note being drawn to the attention of and being available for inspection by that person; and (b) attach a copy of the note to the notice referred to in subsection (1) which relates to the data correction request. (3) In this section, “expression of opinion” includes an assertion of fact which is unverifiable or in all circumstances of the case is not practicable to verify. 21. Withdrawal of consent to process personal data.- (1) A data subject may by notice in writing withdraw his consent to the processing of personal data in respect of which he is the data subject. (2) The data controller shall, upon receiving the notice under subsection (1), cease the processing of the personal data. (3) The failure of the data subject to exercise the right conferred by subsection (1) does not affect any other rights conferred on him by this Part. (4) A data controller who contravenes subsection (2) commits an offence and shall, on conviction, be liable to a fine not exceeding one million rupees or to imprisonment for a term not exceeding one year or to both. 22. Extent of disclosure of personal data​.- Notwithstanding section 7, personal data of a data subject may be disclosed by a data controller for any purpose other than the purpose for which the personal data was to be disclosed at the time of its collection or any other purpose directly related to that purpose, only under the following circumstances: (a) the data subject has given his consent to the disclosure; (b) the disclosure — (i) is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations; or (ii) was required or authorized by or under any law or by the order of a court; (c) the data controller acted in the reasonable belief that he had in law the right to disclose the personal data to the other person; (d) the data controller acted in the reasonable belief that he would have had the consent of the data subject if the data subject had known of the disclosing of the personal data and the circumstances of such disclosure; or (e) the disclosure was justified as being in the public interest in circumstances as determined by the Commission in advance of the disclosure. 13