A’ 137/29.08.2019 3389 GOVERNMENT GAZETTE 2. The grounds for refusing to provide information to the data subject should be documented. Refusal to provide information should be justified to the data subject unless the disclosure of the factual or legal reasons on which the refusal is based would compromise the purpose pursued by the refusal to provide information. Data stored for the purpose of providing information to the data subject and for the preparation of such provision may be processed solely for that purpose and for purposes of data protection; the processing for other purposes shall be limited in accordance with Article 18 of the GDPR. 3. The right of access by the data subject to personal data that are neither subject to automated nor to nonautomated processing by a public authority, and stored in a filing system, shall only apply if the data subject provides information allowing the retrieval of data and the effort required to provide the information is not disproportionate to the interest of the data subject in being informed. 4. The data subject's right to be informed under Article 15 of the GDPR shall not apply to the extent that the provision of information would entail the disclosure of information which, according to the law or by reason of its nature, in particular due to overriding legitimate interests of third parties, should remain confidential. 5. The obligation to notify under Article 34 of the GDPR, with the exception of the exemption referred to in Article 34(3) of the GDPR, shall not apply to the extent that the obligation to notify would entail the disclosure of information which, according to the law or by reason of its nature, in particular due to overriding legitimate interests of third parties, should remain confidential. By way of derogation from the previous subparagraph, the data subject must be informed, in accordance with Article 34 of the GDPR, where his or her interests, in particular taking into account imminent damage, override the interest relating to maintaining confidentiality. Article 34 Right to erasure 1. If, in the case of non-automated processing, erasure is not possible due to the particular nature of storage or is only possible with disproportionate effort, and the interest of the data subject in erasure is not considered significant, the data subject’s right and the controller’s obligation to erase personal data in accordance with Article 17(1) of the GDPR, shall not apply, with the exception of the exemptions referred to in Article 17(3) of the GDPR. In this case, erasure shall be replaced by restriction of processing in accordance with Article 18 of the GDPR. The above subparagraphs shall not apply if the personal data have been unlawfully processed. 2. In addition to points (b) and (c) of Article 18(1) of the GDPR, the first and second subparagraphs of the previous paragraph shall apply accordingly in the case of points (a) and (d) of Article 17(1) of the GDPR, to the extent that the controller has reason to believe that the erasure would be prejudicial to the legitimate interests of the data subject. The controller shall inform the data subject of the restriction of processing where such information is not impossible or does not involve a disproportionate effort. 3. In addition to point (b) of Article 17(3) of the GDPR, paragraph 1 shall apply accordingly in the case of point (a) of Article 17(1) of the GDPR, if erasure would be in conflict with statutory or contractual retention periods. Article 35 Right to object The right to object under Article 21(1) of the GDPR shall not be applicable where a public body is concerned, if there is a compelling public interest in the processing which overrides the interests of the data subject or if processing is mandatory by law. Article 36 Ensuring the processing of personal data for national security purposes The processing of personal data of the National Intelligence Service (NIS) staff conducted by public and private bodies in the context of their tasks or responsibilities shall be performed by specifically authorised officers, whose names shall be communicated to the NIS. Any further transmission of the above personal data shall only be conducted upon approval of the NIS. Article 37 Accreditation certification of certification bodies and 1. The accreditation of bodies which issue certifications under Article 42 of the GDPR shall be carried out by the National Accreditation System (ESYD) in accordance with EN-ISO/IEC17065:2012 and additional requirements established by the Authority. 2. The ESYD shall revoke an accreditation if notified by the Authority that the requirements for accreditation are no longer met or the certification body infringes the GDPR and the provisions hereof. Article 38 Criminal penalties 1. Anyone who, without legal grounds: (a) interferes in any way with a data filing system and in so doing is made aware of such data; (b) copies, removes, alters, harms, collects, registers, organises, structures, stores, adapts, modifies, recovers, seeks information, correlates, combines, restricts, erases, destroys, shall be punished with imprisonment of up to one (1) year, unless the act is punishable with a more severe penalty under another provision. 2. Anyone who uses, transmits, disseminates, discloses by transmission, makes available, announces or makes accessible to unauthorised persons personal data acquired pursuant to indent (a) of paragraph 1, or allows unauthorised persons to become aware of such data, shall be punished with imprisonment, unless the act is punishable with a more severe penalty under another provision. 3. If the act referred to in paragraph 2 relates to special categories of personal data referred to in Article 9(1) of the GDPR or data relating to criminal convictions and offences or relevant security measures referred to in Article 10 of the