(1) A data controller shall not provide, use, obtain, procure or provide information related to a data subject for the purposes of direct marketing without the prior written consent of the data subject.

(2) A data subject is entitled at any time by notice in writing to a data controller to require the data controller not to process personal data of that data subject for the purposes of direct marketing.

(3) Where the Commission is satisfied on a complaint by a person who has given notice in subsection (1), that the data controller has failed to comply with the notice, the Commission may order that data controller to comply with the notice.

(4) In this section “direct marketing” includes the communication by whatever means of any advertising or marketing material which is directed to particular individuals.