3394 GOVERNMENT GAZETTE the natural persons from whom the personal data originate, where such information is likely to endanger his or her life or physical integrity and fundamental freedoms, as well as in the case of protected witnesses or informants. 6. The controller shall inform the data subject in writing, without delay, of his or her decision to refuse or restrict access. The above notification obligation of the controller shall not apply where the provision of such information gives rise to a risk in accordance with paragraph 2 of the previous Article. The above notification shall include the factual or legal reasons on which the refusal or restriction is based, unless such justification would compromise the intended purpose of the refusal or restriction of access. 7. In case of refusal or restriction of access, the data subject, pursuant to the previous paragraph, shall be informed of the possibility of exercising the right of access through the Authority, and, in particular, the possibility of lodging a complaint with the Authority under Article 58, and of bringing an action for annulment against the Authority’s negative decision before the Council of State. The decision of the controller shall be transmitted to the Authority, unless the controller invokes national security concerns. In the case of a complaint lodged with the Authority, the latter shall investigate whether the conditions necessary for the restriction of the right are met and shall inform the subject at least that all necessary verifications or reviews have been carried out by the Authority, as well as whether the provisions on the protection of personal data have been infringed. 8. The controller shall document the factual or legal reasons on which the decision is based. Article 56 Right to rectification or erasure of personal data and restriction of processing (Article 16 of the Directive) 1. The data subject shall have the right to obtain from the controller without delay the rectification of inaccurate personal data relating to him or her. In particular, in the case of statements or decisions, the question of accuracy is irrelevant to the content of the statement or decision. If the accuracy or inaccuracy of personal data cannot be ascertained, the controller shall restrict the processing instead of deleting the data. In such a case, the controller shall inform the data subject before resuming the restriction. The data subject may also request to have incomplete personal data completed, where this is reasonable, taking into account the purposes of the processing. 2. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without delay, where the processing of such data infringes the provisions of this Chapter, the knowledge of those data is no longer necessary for the performance of tasks or those data must be erased, so as to allow the controller to fulfil a legal obligation. 3. Instead of erasing personal data, the controller shall restrict the processing, where: (a) there is reason to assume that the erasure would compromise the legitimate interests of the data subject, (b) the personal data are to be kept, provided they serve A’ 137/29.08.2019 as evidence for the purposes of Article 43, or (c) erasure would be impossible or would involve a disproportionate effort due to the special storage mode. Personal data subject to restricted processing, in accordance with the above, may be processed only for the purpose preventing their erasure. 4. In automated filing systems, technical measures should ensure that the restriction of processing is easily visible and that processing for other purposes is not possible without further examination. 5. Where the controller has rectified inaccurate personal data, he or she shall notify the rectification to the body from which the controller obtained the data. In case of rectification, erasure or restriction of processing in accordance with paragraphs 1 to 3, the controller shall inform the recipients to whom the personal data have been transmitted of those measures. The recipient shall rectify or erase the personal data or restrict their processing. 6. The controller shall inform the data subject in writing of any refusal of rectification or erasure of personal data or restriction of their processing. This shall not apply where the provision of such information gives rise to a risk in accordance with Article 54(2). The information referred to in the previous subparagraph shall include the reasons for such refusal, unless such reasons compromise the intended purpose of the refusal. 7. In other respects, paragraphs 7 and 8 of the previous Article shall apply accordingly. Article 57 Modalities for exercising the rights of the data subject (Article 12 of the Directive) 1. The controller shall communicate with the data subject in a concise, intelligible and easily accessible form, using clear and plain language, in particular when addressing minors. The information shall be provided without prejudice to specific provisions by any appropriate means, including by electronic means. The controller should provide the information in the same form as the request. 2. Without prejudice to Article 55(5) and Article 56(6), the controller shall without delay inform the data subject of the status of his or her request. 3. The information provided in accordance with Article 53, any communication made in accordance with Articles 54 and 64, as well as the requests processed in accordance with Articles 55 and 56, shall not be subject to a fee. Where a request in accordance with Articles 55 and 56 is manifestly unfounded or is being abused, the controller may charge a reasonable fee based on administrative costs or may refuse to act on the request. In this case, the controller must be able to demonstrate the manifestly unfounded or excessive character of the request. 4. Where the controller has reasonable doubts concerning the identity of the data subject making the request referred to in Articles 55 and 56, the controller may request the provision of additional information necessary to confirm the identity of the data subject.