102 No. 3 of 2021] Data Protection (3) Prior to giving consent, the data subject shall be informed of the data subject’s right to withdraw the consent. (4) A data controller shall, where processing is based on consent, demonstrate that the data subject has consented to the processing. (5) Where a data subject consents in the form of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. (6) A data subject shall have the right to withdraw consent at any time. (7) The withdrawal of consent shall not affect the lawfulness of processing based on consent under subsection (5) before its withdrawal and all personal data collected following withdrawal of the consent shall, subject to the provisions of this Act, be destroyed immediately. (8) A data subject may object, at any time, to the processing of that data subject’s personal data. (9) Where a data subject has objected to the processing of that data subject’s personal data, the data controller or data processor shall no longer process that personal data. Collection of personal data 16. (1) Subject to subsection (2), a data controller shall collect personal data directly from a data subject. (2) A data controller may collect personal data from a source other than the data subject if— (a) the data is contained in or derived from a public record or has intentionally been made public by the data subject; (b) the data subject has consented to the collection of data from another source; (c) collection of data from another source would not prejudice the interest of the data subject; (d) collection of data from another source is necessary— (i) to avoid prejudice to the maintenance of the law and order by any public body, including the prevention, detection, investigation, prosecution and punishment of an offence;