Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or 19, or has been obtained in violation of the provisions of Article 20.
If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.
Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) or Article 28.
If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.
An identifiable person may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify the person, or cease to provide a third party with the personal data the business holds, if it has ceased to be necessary for the business to use that personal data, if the situation concerning that personal data as prescribed in the main text of Article 26, paragraph (1) has occurred, or if handling that personal data is likely to harm the identifiable person's rights and interests.
If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.
If a business handling personal information have ceased to use or deleted, or decided not to cease to use or delete all or part of personal data the business holds in connection with a request under paragraph (1) or (5), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds in connection with a request under paragraph (3) or (5), the business must notify the identifiable person to that effect without delay.