he data subject shall have the right to request the Data Controller to erase or destroy the Personal Data, or anonymize the Personal Data to become the anonymous data which cannot identify the data subject, where the following ground applies:
(1) the Personal Data is no longer necessary in relation to the purposes for which it was collected, used or disclosed;
(2) the data subject withdraws consent on which the collection, use, or disclosure is based on, and where the Data Controller has no legal ground for such collection, use, or disclosure;
(3) the data subject objects to the collection, use, or disclosure of the Personal Data referred in Section 32 (1), and the Data Controller cannot reject to such request as referred in section 32 (1) (a) or (b), or where the data subject exercise his or her right to object as referred in section 32 (2);
(4) the Personal Data have been unlawfully collected, used, or disclosed under
Paragraph one shall not apply to the extent that such Personal Data retention is necessary for the purpose of freedom of expression, the purpose under section 24 (1) or (4) or section 26(5) (a) or (b), the purpose of establishment, compliance or exercise of legal claims, or defense of legal claims, or the purpose for compliance with the law.
Where the Data Controller has made the Personal Data disclose to public and is requested to erase or destroy the Personal Data, or make the Personal Data become the anonymous data which cannot identify the data subject pursuant to paragraph one, the Data Controller shall be responsible for the course of action, both the implementation of technology and the expenses to fulfil the request, and inform other Data Controllers in order to obtain their responses regarding the action to be taken to fulfil such request.
In the event that the Data Controller does not take action in accordance with paragraph one or three, the data subject shall have the right to complain to expert committee to order the Data Controller to take such action.
The Committee may announce the rules for the erasure or destruction of Personal Data, or anonymization of the Personal Data to become the anonymous data which cannot identify the data subject pursuant to paragraph one.