No. 24 of 2019 Data Protection [Subsidiary] (2) Where the data subject is a child, a data controller or data processor shall ensure that— (a) a person exercising the right is appropriately identified; (b) profiling of a child that is related to direct marketing is prohibited; and (c) the parent or guardian is informed of the inherent risks in processing and the safeguards put in place. (3) Where a data controller or a data processor is uncertain as to the existence of a relationship between the duly authorised person and the data subject, the data controller or data processor may restrict the request of exercising a right on behalf of the data subject until evidence to the contrary is adduced. PART III – RESTRICTIONS ON THE COMMERCIAL USE OF PERSONAL DATA 14. Interpretation of commercial purposes (1) For the purposes of section 37 (1) of the Act, a data controller or data processor shall be considered to use personal data for commercial purposes where personal data of a data subject is used to advance commercial or economic interests, including inducing another person to buy, rent, lease, join, subscribe to, provide or exchange products, property, information or services, or enabling or effecting, directly or indirectly, a commercial transaction. (2) A data controller or data processor is considered to use personal data to advance commercial interests where personal data is used for direct marketing through— (a) sending a catalogue through any medium addressed to a data subject; (b) displaying an advertisement on an online media site where a data subject is logged on using their personal data; or (c) sending an electronic message to a data subject about a sale, or other advertising material relating to a sale, using personal data provided by a data subject. (3) Marketing is not direct where personal data is not used or disclosed to identify or target particular recipients. 15. Permitted commercial use of personal data (1) A data controller or data processor may use personal data, other than sensitive personal data, concerning a data subject for the purpose of direct marketing where— (a) the data controller or data processor has collected the personal data from the data subject; (b) a data subject is notified that direct marketing is one of the purposes for which personal data is collected; (c) the data subject has consented to the use or disclosure of the personal data for the purpose of direct marketing; (d) the data controller or data processor provides a simplified opt out mechanism for the data subject to request not to receive direct marketing communications; or (e) the data subject has not made an opt out request. (2) A data controller or data processor shall not transmit, for the purposes of direct marketing, messages by any means unless the data controller or data processor indicates particulars to which a data subject may send a request to restrict such communications without incurring charges. (3) A person shall neither transmit, nor instigate the transmission of, a communication for the purposes of direct marketing by means of electronic mail— (a) where the identity of the person on whose behalf the communication has been sent has been disguised or concealed; 24