Cap. 659 Art. 37Protection of the rights of the data  subjects.     Cap. 586. 26 [CAP.

(1) With respect to all the processing of personal data pursuant to this Act, every data subject shall have the right of access, rectification, erasure and restriction, including the right to lodge a complaint with the Information and Data Protection Commissioner, the right to compensation and judicial redress as laid down in the Data

Protection Act and Regulation (EU) 2016/679.

(2) The controller may restrict the rights and obligations provided for in Articles 14 to 20 and Article 34 of Regulation (EU) 2016/679 in accordance with Article 23 thereof.

(3) The restrictions under sub-article (2) shall only apply where these restrictions are considered as a necessary and proportionate measure for the performance of the functions of the controller pursuant 659.] VULNERABILITY to this Act, or to protect the vital interests of the adults in need of assistance or protection, or to effectively preserve the integrity of the delivery of the professional services provided by the controller to such persons.

(4) The data protection officer designated pursuant to Article 37 of Regulation (EU) 2016/679 shall be consulted by the controller as appropriate and in a timely manner in the entire process of applying the restriction.

(5) The controller shall apply the restrictions referred to in sub-article (3) for as long as the reasons justifying them remain applicable, following a necessity and proportionality test. The reasons justifying the restrictions shall be documented and made available to the Information and Data Protection Commissioner when and as required.

(6) Where the reasons for a restriction no longer apply, the controller shall lift the restriction and inform the data subject concerned accordingly and comply with the rights and obligations provided for in Articles 14 to 20 and Article 34 of Regulation (EU) 2016/679.

(7) The controller shall review the application of the restrictions referred to in this article and depending on the outcome of such review inform the data subject accordingly.