Section 19

The Data Controller shall not collect, use, or disclose Personal Data,

unless the data subject has given consent prior to or at the time of such collection, use,
or disclosure, except the case where it is permitted to do so by the provisions of this Act or any other laws.

A request for consent shall be explicitly made in a written statement, or via electronic means,

unless it cannot be done by its nature.

In requesting consent from the data subject, the Personal Data Controller shall also inform

the purpose of the collection, use, or disclosure of the Personal Data. Such request for consent
shall be presented in a manner which is clearly distinguishable from the other matters,
in an easily accessible and intelligible form and statements, using clear and plain language,
and does not deceptive or misleading to the data subject in respect to such purpose. In this regard,
the Committee may require the Data Controller to request for data subject's
consent in accordance with the form and statements as prescribed by the Committee.

In requesting consent from the data subject, the Data Controller shall utmost take into account

that the data subject's consent is freely given. Also, the entering into the contract,
including any provisions of the service shall not be a condition to obtaining consent for
the collection, use, or disclosure of Personal Data that is not necessary or not related
to such contract entering, including the provisions of the service.

The data subject may withdraw his or her consent at any time. The withdrawal of consent shall

be as easy as to giving consent, unless there is a restriction of the withdrawal of consent by law,
or the contract which gives benefits to the data subject. However, the withdrawal of consent shall
not affect the collection, use, or disclosure of personal data that the data subject
has already given consent legally under this Chapter.

In the event that the withdrawal of consent will affect the data subject in any manner,

the Data Controller shall inform the data subject of such consequences of consent's withdrawal.

The request for the data subject’s consent which is not in accordance with those prescribed

in this Chapter shall have no binding effect on the data subject and shall no longer enable
the Data Controller to collect, use, or disclose the Personal Data.