requested by the controller or jointly by the corresponding controllers under
Article 23.
2. The combination of personal data must be necessary for pursuing the legal or
statutory purposes and legitimate interests of the controller, must not involve
discrimination or a reduction in the fundamental rights and freedoms of the data
subjects, and must be covered by adequate security measures and take account
of the type of data subject combination.
Section II
Rights of the data subject
Article 11
(Right to information)
1. The controller or his representative shall provide a data subject from whom data
relating to himself are collected with the following information, except where he
already has such information:
a) the identity of the controller and of his representative, if any;
b) the purposes of the processing;
c) the recipients or categories of recipients;
d) the obligatory or voluntary nature of the replies as well as the possible
consequences of failure to reply;
e) the existence and conditions of the right of access and the right to rectify
provided they are necessary, considering specific circumstances of collection
of the data in order to guarantee the data subject that they will be processed
fairly;
f) the decision of providing personal data for the first time to a third party for
purposes provided in 13 c), previously and with expressed indication that it
is his right to be against such communication;
g) the decision that his personal data be used by a third party, previously and
with expressed indication that it is his right to be against such
communication;
2. The documents supporting the collection of personal data shall contain the
information set down in the previous number.
3. If the data are not collected from the data subject and except where he already
has such data, the controller or his representative must provide the data subject
with the information set down in 1 at the time of undertaking the
recording/registering of data or, if a disclosure to third parties is envisaged, no
later than the time the data are first disclosed.
4. If data are collected from open networks, the data subject shall be informed,
except where he is already aware of this, that personal data relating to him may
be circulated on the network without security measures and may be at risk of
being seen and used by unauthorised third parties.
5. The obligation to provide information may be waived for reasons of State
security, crime prevention and investigation and also when processing data for
statistical, historical and scientific research purposes, when the
information/identification of the data subject would seem impossible involve a