(1) A person may, at any time, by notice in writing, request a data controller —
(a) to stop; or
(b) not to begin,
the processing of personal data in respect of which he or she is a data subject, for the purposes of direct marketing.
(2) Where the data controller receives a request under subsection (1)(a), he or she shall, without delay and in any event not more than 30 days after the request has been received, where the personal data are kept —
(a) only for purposes of direct marketing, erase the data; and
(b) for direct marketing and other purposes, stop processing the personal data for direct marketing.
(3) Where the data controller receives a request under subsection (1)(b), the data controller —
(a) shall, where the personal data are kept only for the purpose of direct marketing, as soon as reasonably practicable and in any event not more than 30 days after the request has been received, erase the personal data; or
(b) shall not, where the personal data are kept for direct marketing and other purposes, process the personal data for direct marketing after the expiry of 30 days.
(4) The data controller shall notify the data subject in writing of any action taken under subsections (2) and (3) and, where appropriate, inform the data subject of the other purposes for which the personal data is being processed.
(5) Where a data controller fails to comply with a notice issued under subsection (1), the data subject may make a complaint to the Commissioner.
(6) In this section, “direct marketing” means a communication, by whatever means, of any advertising or marketing material which is directed to particular individuals.