21.1.2. Data processed for grounds and purposes other than processing data with the consent of data subject and transfer of such processed data to third parties. 21.1.3. Change of conditions specified in Paragraph 8.2 of this Law following the collection of the data from the data subject. 21.2. The data controller may submit a notice for the collection, processing and use of the information of the data subject, except for the cases specified in Paragraph 21.1 of this Law. Article 22. Notification of Violations in the Data Collection, Processing and Use 22.1. The data processor specified in Paragraph 19.1 of this Law shall immediately notify the data controller of any violations identified during data collection and processing. 22.2. If the violation specified in Paragraph 22.1 of this Law harms the rights and legitimate interests of the data subject, the data controller shall immediately notify the data subject. 22.3. The notice specified in Paragraph 22.2 of this Law shall contain the following: 22.3.1. Data subject and data records related to the violation. 22.3.2. Name and contact information of the data subject 22.3.3. Violation and possible negative consequences. 22.3.4. Responses to eliminate the violation and potential negative consequences. 22.4. The data subject shall have the right to file a complaint to the relevant authority in accordance with the law if he or she considers that his or her rights and legitimate interests have been harmed due to the violation specified in Paragraph 22.2 of this Law. 22.5. The data controller shall keep a record of the response taken to eliminate the violation and its negative consequences. 22.6. The record specified in Paragraph 22.5 of this Law shall be submitted to the National Human Rights Commission in January of each year or as requested. Article 23. Assessment 23.1. The data controller may use electronic data processing technology for data collection, processing, and use without any human involvement, and an assessment shall be completed in following cases: 23.1.1. Decision-making which could potentially affect the rights, freedoms, and legitimate interests of the data subject. 23.1.2. Regular processing of sensitive personal data. 23.2. Data shall be collected, processed and used using electronic data processing technology based on the recommendations of the National Human Rights Commission provided for the assessment specified in Paragraph 23.1 of this Law. 23.3. The state central administrative body in charge of digital development and communication shall approve the methodology and procedure for conducting the assessment specified in Paragraph 23.1 of this Law based on the proposal of the National Human Rights Commission. Chapter six data protection authority Article 24. Full Power of the National Human Rights Commission for Information Protection: 24.1. The National Human Rights Commission shall exercise the following full powers with