Section 21

The Data Controller shall collect, use, or disclose Personal Data

according to the purpose notified to the data subject prior to or at the time of such collection.

The collection, use, or disclosure of Personal Data shall not be conducted in a

manner that is different from the purpose previously notified to the data subject
in accordance with paragraph one, unless:

(1)the data subject has been informed of such new purpose, and the consent is

obtained prior to the time of collection, use, or disclosure;

(2)it can be done by the provisions of this Act or in other laws.