12
Notification to the supervisory authority
Notification duty
Section 36
Processing of personal data that is completely or partially automated is subject to a notification
duty. The controller of personal data shall provide a written notification to the supervisory
authority before such processing or a set of such processing with the same or similar purpose
is conducted.
If the controller of personal data appoints a personal data representative, this shall be notified
to the supervisory authority. Removal from office of a personal data representative shall also
be notified to the supervisory authority.
The Government or the authority appointed by the Government may issue regulations
concerning exemptions to the notification duty under the first paragraph for such kinds of
processing as would probably not result in an improper intrusion of personal integrity.
Notification need not be made if there is a personal data representative
Section 37
Notification under Section 36, first paragraph, need not be made if the controller of personal
data has given notice to the supervisory authority that a personal data representative has been
appointed and who he/she is.
The functions of personal data representatives
Section 38
The personal data representative shall have the function of independently ensuring that the
controller of personal data processes personal data in a lawful and correct manner and in
accordance with good practice and also points out any inadequacies to him or her.
If the personal data representative has reason to suspect that the controller of personal data
contravenes the provisions applicable for processing personal data and if rectification is not
implemented as soon as is practicable after being pointing out, the personal data representative
shall notify this situation to the supervisory authority.
The personal data representative shall also otherwise consult with the supervisory authority in
the event of doubt about how the rules applicable to processing of personal data shall be
applied.
Section 39
The personal data representative shall maintain a register of the processing that the controller
of personal data implements and which would have been subject to the duty of notification if
the representative had not existed. The register shall comprise at least the information that a
notification under Section 36 would have contained.
Section 40
The personal data representative shall assist registered persons to obtain rectification when
there is reason to suspect that the personal data processed is incorrect or incomplete.