(1) A data subject is entitled at any time, by notice given to the controller, to require the controller -
(a) not to process personal data relating to the data subject, or
(b) not to process such data for a specified purpose or in a specified manner,
on the ground that, for specified reasons relating to the situation of the data subject, the processing in question is an unwarranted interference with the interests or rights of the data subject.
(2) Where the controller -
(a) reasonably requires further information -
(i) in order that the controller be satisfied as to the identity of the individual giving notice under subsection (1), or
(ii) to locate the data to which the notice relates, and
(b) has informed that individual of that requirement,
the controller is not obliged to comply with the notice unless the controller is supplied with that further information.
(3) The controller must, before the end of 21 days beginning with the relevant time, give a notice to the data subject -
…