Subject to subsection (2), a controller, with respect to personal data for which it isresponsible, may restrict, wholly or partly, the exercise of a right of a data subjectspecified in subsection (4)
Can restrict, but must be necessary and proportionate (and under one of the restriction rights)