requested by the controller or jointly by the corresponding controllers under Article 23. 2. The combination of personal data must be necessary for pursuing the legal or statutory purposes and legitimate interests of the controller, must not involve discrimination or a reduction in the fundamental rights and freedoms of the data subjects, and must be covered by adequate security measures and take account of the type of data subject combination. Section II Rights of the data subject Article 11 (Right to information) 1. The controller or his representative shall provide a data subject from whom data relating to himself are collected with the following information, except where he already has such information: a) the identity of the controller and of his representative, if any; b) the purposes of the processing; c) the recipients or categories of recipients; d) the obligatory or voluntary nature of the replies as well as the possible consequences of failure to reply; e) the existence and conditions of the right of access and the right to rectify provided they are necessary, considering specific circumstances of collection of the data in order to guarantee the data subject that they will be processed fairly; f) the decision of providing personal data for the first time to a third party for purposes provided in 13 c), previously and with expressed indication that it is his right to be against such communication; g) the decision that his personal data be used by a third party, previously and with expressed indication that it is his right to be against such communication; 2. The documents supporting the collection of personal data shall contain the information set down in the previous number. 3. If the data are not collected from the data subject and except where he already has such data, the controller or his representative must provide the data subject with the information set down in 1 at the time of undertaking the recording/registering of data or, if a disclosure to third parties is envisaged, no later than the time the data are first disclosed. 4. If data are collected from open networks, the data subject shall be informed, except where he is already aware of this, that personal data relating to him may be circulated on the network without security measures and may be at risk of being seen and used by unauthorised third parties. 5. The obligation to provide information may be waived for reasons of State security, crime prevention and investigation and also when processing data for statistical, historical and scientific research purposes, when the information/identification of the data subject would seem impossible involve a