44 Personal Data Protection Act, No. 9 of 2022 (c) the management of the affairs of the Authority; (d) the form and manner of exercising rights of data subjects under Part II; (e) criteria for refusal of the request of data subjects under section 17. (f) all matters for which, rules are required or authorized to be made under this Act. (2) The Authority shall make first rules under subsection (1), within twenty-four months from the date of coming into operation of the provisions of Part V of this Act. (3) The Authority shall, prior to making rules under paragraphs (d), (e) or (f) of subsection (1), hold public consultations for a period of not less than two weeks. (4) The period of public consultation referred to in subsection (3) may be extended for a further period as may be specified by the Authority. (5) A rule made under this section shall not have effect until it is approved by the Minister and approved rules and notification of such approval are published in the Gazette. (6) Every rule made under paragraphs (d), (e) or (f) of subsection (1), shall within three months after its publication in the Gazette be brought before Parliament for approval and any rule, which is not so approved, shall be deemed to be rescinded with effect from the date of such disapproval, but without prejudice to anything previously done thereunder.