Section 33

The data subject shall have the right to request the Data

Controller to erase or destroy the Personal Data, or anonymize the Personal Data to become
the anonymous data which cannot identify the data subject, where the following ground applies:

(1)the Personal Data is no longer necessary in relation to the purposes for

which it was collected, used or disclosed;

(2)the data subject withdraws consent on which the collection, use, or

disclosure is based on, and where the Data Controller has no legal ground
for such collection, use, or disclosure;

(3)the data subject objects to the collection, use, or disclosure of the Personal

Data referred in section 32 (1), and the Data Controller cannot reject to such request
as referred in section 32 (1) (a) or (b), or where the data subject exercise his or her
right to object as referred in section 32 (2);

(4)the Personal Data have been unlawfully collected, used, or disclosed under this Chapter.

Paragraph one shall not apply to the extent that such Personal Data retention is

necessary for the purpose of freedom of expression, the purpose under
section 24 (1) or (4) or section 26 (5) (a) or (b), the purpose of establishment,
compliance or exercise of legal claims, or defense of legal claims, or the purpose for compliance with the law.

Where the Data Controller has made the Personal Data disclose to public and is

requested to erase or destroy the Personal Data, or make the Personal Data become
the anonymous data which cannot identify the data subject pursuant to paragraph one,
the Data Controller shall be responsible for the course of action, both the
implementation of technology and the expenses to fulfil the request,
and inform other Data Controllers in order to obtain their responses regarding
the action to be taken to fulfil such request.

In the event that the Data Controller does not take action in accordance with

paragraph one or three, the data subject shall have the right to complain to
expert committee to order the Data Controller to take such action.

The Committee may announce the rules for the erasure or destruction of Personal Data,

or anonymization of the Personal Data to become the anonymous data which cannot
identify the data subject pursuant to paragraph one.