33. (1) Subject to subsection (3), in accordance with Article 17, a controller shall, at the request of a data subject, without undue delay erase personal data of the data subject where the data have been collected in relation to the offer to that data subject of information society services referred to in Article 8(1).

(2) Subject to subsection (3), where a controller has disclosed the personal data which are the subject of a request under subsection (1) to another controller or controllers, the first-mentioned controller shall, taking account of available technology and the cost of implementation, take all reasonable steps, including technical measures, to inform the other controller or controllers which are processing that personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

(3) Subsections (1) and (2) shall not apply to the extent that the processing of the personal data concerned is necessary for the purposes set out in Article 17(3).