exercise, discharge or perform any of the power, duties or functions of the head of the data controller under this Act that are specified in the order. 59 Subject to the exhaustion of the appeal offered through the Commission under this law, the data subject shall be entitled to pursue legal appeals with the relevant judicial authorities. 60 The law maker shall set up a class action system to assist of the data subject in the exercise of their rights set up under this law. 61 (1) For the regulation of whistleblowing: (a) The Commission shall establish rules giving the authorization for and governing the whistleblowing system. (b) These rules must preserve: (i) the principles of fairness, lawfulness and purpose of the processing; (ii) the principles related to the proportionality as the limitation of the scope, accuracy of the data which will be processed; (iii) the principle of openness with delivering an adequate collective and individual information on:  the scope and purpose of the whistleblowing;  the processing of reporting;  the consequences of the justified and unjustified reporting;  the way of exercising the rights of access, to rectification, deletion as well as the competent authority to which a request can be made;  the third party which may receive personal data concerning the informer and the person who is implicated in the scope of the processing of the reporting (for example the internal audit service if the "manager of the reporting" needs to verify some points). The person who is implicated shall be informed as soon as possible by the manager