6. Amendment of section 19 of the principal enactment

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

Section 19 of the principal enactment is hereby amended by the repeal of subsections (1), (2) and (3) thereof and the substitution therefor of the following subsections:-

“(1) Where a controller–

(a)

has refused to provide access to personal data under section 13;

(b)

has refused to allow withdrawal of consent under section 14(1) or refused to refrain from further processing of personal data under section 14(2);

(c)

has refused to rectify or complete personal data under section 15;

(d)

has refused to erase personal data under section 16;

(e)

has refused a request of the data subject under section 17(2); or

(f)

has refused a request to review a decision based solely on automated processing under section 18(1), the data subject may, appeal to the Authority against such refusal in such form, manner and within such period of time as may be prescribed.

(2)

Upon receipt of an appeal under subsection (1), the

Authority may determine whether the–

(a)

decision of the controller to refuse to provide access to personal data under section 13 was lawful;

(b)

decision of the controller to refuse to allow withdrawal of consent under section 14(1) or not to refrain from further processing of personal data under section 14(2) was lawful;

(c)

decision of the controller to refuse to rectify or complete personal data under section 15 was lawful;

(d)

decision of the controller to refuse the erasure of personal data under section 16 was lawful;

(e)

refusal under section 17(2) by the controller was lawful; or

(f)

refusal to review a decision based solely on automated processing under section 18(1) was lawful.

(3)

Upon receipt of an appeal under subsection (1) and after concluding the necessary investigations, the Authority shall determine within such period as may be prescribed-

(a)

whether the appeal is allowed; or

(b)

whether the appeal is disallowed, with reasons therefor, and the Authority shall inform to the data subject and the controller of such determination.”.

Read on from s 7