(1) A person who can represent a data subject under Article 38 of the Act shall be any of the following: 1. A legal representative of the data subject; 2. A person delegated by the data subject.

(2) A representative referred to in paragraph (1), representing a data subject pursuant to Article 38 of the Act, shall submit a power of attorney of the data subject, in the form prescribed by Notification of the Protection Commission, to the personal information controller.