(1) A data subject may mandate a body, organisation or association to which subsection (2) applies to do either or both of the following on his or her behalf:

(a) lodge a complaint under section 119;

(b) exercise the rights referred to in section 128 and section 150.

(2) This subsection applies to a body, organisation or association -

(a) that provides its services on a not-for-profit basis,

(b) that has been properly constituted in accordance with the law of the State or another Member State,

(c) whose objectives, as specified in the documents establishing the body, organisation or association concerned, are in the public interest, and

(d) that is active with regard to the protection of data subject rights and freedoms, including protection of their personal data.

(3) Where the Commission or a court, in performing its functions under this Act, has reasonable doubts as to whether a particular body, organisation or association is one to which subsection (2) applies, it may request the provision by the body, organisation or association concerned of such additional information as is necessary in order to confirm that it is such a body, organisation or association.