instrument prescribe further conditions which may be taken by a data controller
for the maintenance of appropriate safeguards for the rights and freedoms of a
data subject related to processing of special personal data.
Exemption related to religious or philosophical beliefs of data subject
38. (1) The prohibition on processing of personal data which relates to the
religious or philosophical beliefs of a data subject does not apply if the
processing is carried out by
(a) a spiritual or religious organisation or a branch of the organisation and the processing is in respect of persons who are
members of the organisation,
(b) an institution founded on religious or philosophical principles and
the processing is
(i) with respect to the members, employees or other persons
belonging to the institution,
(ii) consistent with the objects of the institution, and
(iii) necessary to achieve the aims and principles of the
institution.
(2) An individual who believes that data is being processed under subsection
(1) may at any time by notice in writing to a data controller require a data
controller to provide particulars of data processed under this exemption.
Right to prevent processing of personal data
39. (1) An individual shall at any time by notice in writing to a data controller
require the data controller to cease or not begin processing for a specified
purpose or in a specified manner, personal data which causes or is likely to
cause unwarranted damage or distress to the individual.
(2) A data controller shall within twenty-one days after receipt of a notice
inform the individual in writing
(a) that the data controller has complied or intends to comply with
the notice of the data subject, or
(b) of the reasons for non-compliance.
(3) Where the Commission is satisfied that the complainant is justified,
the Commission may order the data controller to comply.
Right to prevent processing of personal data for direct marketing
40. (1) A data controller shall not provide, use, obtain, procure or
provide information related to a data subject for the purposes of direct
marketing without the prior written consent of the data subject.
(2) A data subject is entitled at any time by notice in writing to a data
controller to require the data controller not to process personal data of that data
subject for the purposes of direct marketing.