Section 27

The Data Controller shall not use or disclose Personal Data

without the consent of the data subject, unless it is the Personal Data which is collected without
requirement of consent under section 24 or section 26 .

The Person or juristic person who obtains Personal Data as a result of the

disclosure under paragraph one shall not use or disclose such Personal Data
for any purpose other than the purpose previously notified to the Data Controller
in the request to obtain such Personal Data.

In the event that the Data Controller uses or discloses the Personal Data which

is exempted from consent requirement in paragraph one, the Data Controller shall
maintain a record of such use or disclosure in the record under
section 39 .