Skip to content
srilawsby aturio
As enacted
Contents

Part II · Rights of Data Subjects

19. Right of appeal of the data subjects to the Authority and the process of determination of such appeal

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

(1)

Where a controller–

(a)

has not refrained from further processing of personal data under section 14; or

(b)

has refused to rectify or complete personal data under section 15; or

(c)

has refused to erase personal data under section 16; or

(d)

has refused the request of the data subject under section 17(2); or

(e)

has refused the request to review a decision based solely on automated processing under section 18(1), the data subject may, appeal against such decision in the form, manner and within such period of time as may be prescribed.

(2)

The Authority may determine whether the –

(a)

decision of the controller not to refrain from further processing of personal data under section 14 was lawful;

(b)

decision of the controller to refuse to rectify or complete personal data under section 15

was lawful;

(c)

decision of the controller to refuse the erasure of personal data under section 16 was lawful;

(d)

refusal under section 17(2) by the controller was lawful;

(e)

refusal to review a decision based solely on automated processing under section 18(1)

was lawful.

(3)

After concluding the necessary investigations, the

Authority shall determine, within such period as may be prescribed, whether the appeal is allowed or disallowed and the Authority shall inform the data subject and the controller the determination with reasons thereof.

(4)

Where the Authority allows the appeal under subsection (2), the controller shall take steps to give effect to the decision of the Authority, within such period as may be determined by the Authority, and the controller shall inform the data subject and the Authority, the steps taken to give effect to its decision.

(5)

Any data subject or controller aggrieved by the decision of the Authority, may prefer an appeal to the Court of Appeal not later than thirty days from the date of such decision.

Part III

Controllers and Processors

Read on from Part III

Part IV

Use of Personal Data to Disseminate Solicited Messages

Read on from Part IV

Part V

Data Protection Authority

Read on from Part V

Part VI

Director-General and the Staff of the Authority

Read on from Part VI

Part VII

Penalties

Read on from Part VII

Part VIII

Fund of the Authority

Read on from Part VIII

Part IX

Miscellaneous

Read on from Part IX

Part X

Interpretation

Read on from Part X

Schedules