11 (4) notify the same to the Data Protection Ombudsman. The duty of notification referred to above in paragraph (1) does not apply, if the processing of personal data is based on section 8(1)(1)—(3), on section 8(1)(4) if so provided by law, on a client or service relationship or membership referred to in section 8(1)(5), on section 8(1)(6) or (9), on section 12(1)—(4), on section 12(5) if so provided by law, on section 12(7)—(10), (12) or (13), or on sections 13—18 or 20. The duty of notification may also be derogated from as provided by Decree, if it is evident that the processing of personal data does not compromise the protection of the privacy of the data subject, or his/her rights or freedoms. Section 37 — Notification (1) The notification referred to above in section 36(2)(1) shall indicate the information contained in the description of the file and also the types of data being transferred and how the transfer is carried out. (2) The notification referred to above in section 36(2)(2) shall indicate the information contained in the description of the file and also the logical construction of the system. (3) The notification referred to above in section 36(3) shall indicate the name, field of business, domicile and address of the trader or business, the personal data files used in the activity and the type of data contained therein, the disclosure of data from the file, the duration of storage of recorded data, the technical measures for securing the data and the measures for monitoring the use of the personal data files. (4) The notification shall be made well in advance of the collection or recording of the data to be recorded into the file or of the carrying out of another measure giving rise to the duty of notification; in any event, it shall at the latest be made 30 days before the same. Chapter 9 — Direction and supervision of the processing of personal data Section 38 — Data protection authorities (1) The Data Protection Ombudsman provides direction and guidance on the processing of personal data, supervises the processing in order to achieve the objectives of this Act, as well as makes decisions, as provided in this Act. (2) The Data Protection Board deals with questions of principle relating to the processing of personal data, where these are significant to the application of this Act, as well as makes decisions in matters of data protection, as provided in this Act. (3) The data protection authorities may use the powers provided in this chapter even if the processing of personal data is according to section 4 not subject to the provisions of this Act. The data protection authorities co-operate with the data protection authorities in other Member States of the European Union, providing executive assistance, where necessary. Section 39 — Data protection authorities’ right of access and inspection (1) Regardless of confidentiality provisions, the Data Protection Ombudsman has the right of access to personal data which are being processed, as well as all information necessary for the supervision of the legality of the processing of personal data. The Data Protection Board has the same right in matters which it is dealing with. (2) The Data Protection Ombudsman has the right to inspect personal data files and to assign experts to carry out the inspection. For purposes of the inspection, the Data Protection Ombudsman and an expert have the right to enter the premises of the controller and a person operating on the behalf of the controller, where personal data are processed or personal data files are kept in such premises, and to access the information and equipment required for carrying out the inspection. In premises covered by the provisions on the sanctity of the home, an inspection may be carried out only if in the matter at hand there is a specific reason to believe that the provisions on the processing of personal data have been violated or are going to be violated. The inspection shall be carried out so that it does not cause undue inconvenience or cost to the controller.