16.1. The data subject shall have following rights: 16.1.1. Give or refuse to give a consent to the data controller for data collection on a voluntary basis. 16.1.2. Know whether his or her data has been collected, processed, and used. 16.1.3. Know about the information provided in Paragraph 8.2 of this Law. 16.1.4. Know about the third party who has received or is going to receive the data regarding the data subject to the third party. 16.1.5. Notify the data controller to rectify inaccurate data, make changes, and provide additional data. 16.1.6. Notify the data controller of the data erasure under the law for data erasure. 16.1.7. Demand the erasure of the data if the law prohibits data collection and provides for erasure. 16.1.8. Obtain a copy of the relevant information from the data controller in paper or electronic form. 16.1.9. Transfer a copy of the data specified in Sub-paragraph 16.1.8 of this Law to the selected data controller. 16.1.10. Request cancellation in the course of data collection, processing, and use, and to notify the data controller in writing. 16.1.11. File a complaint or provide an explanation on the decision made as a result of data processing, provide additional data and demand data processing again. 16.2. If the data subject considers that his or her rights and freedoms specified in this law and international treaties of Mongolia have been violated, he or she shall have the right protected and illegal damage and non-pecuniary damage rectified. Article 17. Data Subject's Obligations 17.1. The data subject has following obligations: 17.1.1. Ensure the accuracy and security of the relevant data. 17.1.2. Notify the data controller to rectify inaccurate data, make changes, and provide additional data. 17.1.3. Avoid violating the rights and freedoms of others and affecting their legitimate interests while exercising the rights specified in Sub-paragraph 16.1.9 of this Law. Chapter four data controller and data processor Article 18. Data Controller 18.1. The data controller shall collect, process, and use data based on the grounds specified in the law or with the consent of the data subject. 18.2. The data controller shall have the following responsibilities regarding the data collection, processing and use: 18.2.1. Approve and enforce procedures for data collection, processing and use under the Law.