Acts 2017 505 (b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing; (c) the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing; or (d) the personal data have been unlawfully processed. (3) Where the controller has made the personal data public, he shall take all reasonable steps to inform third parties processing such data, that the data subject has requested the erasure of any links to, or copy or replication of, that personal data. (4) Subsections (2) and (3) shall not apply where the processing of the personal data is necessary – (a) for reasons of public interest in the field of public health; (b) for the purpose of historical, statistical or scientific research; (c) for compliance with a legal obligation to process the personal data to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or (d) for the establishment, exercise or defence of a legal claim. (5) A controller may, at the request of a data subject, restrict the processing of personal data where – (a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data; (b) the controller no longer needs the personal data for the purpose of the processing, but the data subject requires them for the establishment, exercise or defence of a legal claim;