Personal Data (Privacy) Ordinance Part 5—Division 2 5-22 Section 22 Cap. 486 (1) Subject to subsections (1A) and (2), where—  (Amended 18 of 2012 s. 15) (a) a copy of personal data has been supplied by a data user in compliance with a data access request; and (b) the individual, or a relevant person on behalf of the individual, who is the data subject considers that the data is inaccurate, (Amended 18 of 2012 s. 15) then that individual or relevant person, as the case may be, may make a request that the data user make the necessary correction to the data. (1A) If a person is a relevant person in relation to an individual only because the person has been authorized in writing by the individual to make a data access request on behalf of the individual, the person is not entitled to make a data correction request. (Added 18 of 2012 s. 15) (2) A data user who, in relation to personal data— (a) does not hold the data; but (b) controls the processing of the data in such a way as to prohibit the data user who does hold the data from complying (whether in whole or in part) with section 23(1) in relation to a data correction request which relates to the data, shall be deemed to be a data user to whom such a request may be made, and the provisions of this Ordinance (including subsection (1)) shall be construed accordingly. (3) Without prejudice to the generality of sections 23(1)(c) and 25(2), if a data user, subsequent to the receipt of a data correction request but before complying with the request pursuant to section 23 or refusing to comply with the request pursuant to section 25, discloses to a third party the personal data to which the request relates, then the user shall take all Verified Copy Last updated date 20.4.2018