such is the case, his representative, shall notify the Commission for the protection of privacy thereof. The previous section does not apply to the processing of which the sole purpose is the keeping of a register that is intended by law or by virtue of a law, decree or ordinance to provide information to the public and that is open to consultation either by the public in general or by any person demonstrating a legitimate interest. § 2. The Commission shall return within three working days a written receipt of the notification. If the notification is incomplete the Commission shall inform the person submitting the notification thereof. § 3. The notification shall mention: 1° the date of the notification and, if such is the case, the law, decree, ordinance or regulatory instrument establishing the automatic processing; 2° surname, first names and full address or name and registered office of the controller and, if such is the case, his representative in Belgium; 3° [cancelled] 4° the name of the automatic processing; 5° the purpose or the entirety of related purposes of the automatic processing; 6° the categories of the personal data that are processed with a specific description of the data referred to in the Articles 6 to 8; 7° the categories of recipients who may be provided with the data; 8° the guarantees to be linked to the communication of data to third parties; 9° the manner in which the persons to whom the data relate are informed thereof, the service where the right of access may be exercised and the measures taken to facilitate the exercise of that right; 10° the period of time, after the expiration of which the data may no longer be stored, used or disclosed, if such is the case; 11° a general description permitting a preliminary assessment of the appropriateness of the security measures taken pursuant to Article 16 of this law; 12° the grounds that the controller is relying upon for the application of Article 3 § 3 of this law, if such is the case. § 4. Within the scope of its power of supervision and investigation referred to in the Articles 31 and 32, the Commission for the protection of privacy is entitled to demand other items of information, in particular the origin of the personal data, the automation technology selected and the security measures provided for. § 5. Notification is required for any purpose or entirety of related purposes, for which recurrence is taken to a wholly or partly automatic processing operation or set of such operations. 14