12 (3) As regards processing referred to in section 2(5) above, the Data Protection Ombudsman supervises compliance with the obligation to protect the data, provided in section 32. For this purpose, the Data Protection Ombudsman has the right of access to the necessary information on the protection of the data. Section 40 — Measures of the Data Protection Ombudsman (1) The Data Protection Ombudsman shall promote good processing practice and issue directions and guidelines so as to achieve a situation where unlawful conduct is not continued or repeated. Where necessary, the Data Protection Ombudsman shall refer the matter to be dealt with by the Data Protection Board, or report it for prosecution. (2) The Data Protection Ombudsman shall decide matters brought to his/her attention by data subjects on the basis of sections 28 and 29. The Ombudsman may order a controller to realise the right of access of the data subject or to rectify an error. (3) The Data Protection Ombudsman may issue more detailed guidelines on how personal data is to be secured against unlawful processing. Section 41 — Hearing the Data Protection Ombudsman (1) The authority concerned shall reserve the Data Protection Ombudsman an opportunity to be heard in connection with the drafting of legislative or administrative reforms relating to the protection of personal rights or freedoms in the processing of personal data. (2) Before bringing charges for conduct contrary to this Act, the public prosecutor shall hear the Data Protection Ombudsman. When hearing a case of this sort, the court shall reserve the Data Protection Ombudsman an opportunity to be heard. Section 42 — Sectoral codes of conduct Controllers or their representatives may draft sectoral codes of conduct for the application of this Act and the promotion of good processing practice, and send these to the Data Protection Ombudsman. The Data Protection Ombudsman may check if the code of conduct is in conformity with this Act and the other provisions relating to the processing of personal data. Section 43 — Power of the Data Protection Board to grant permissions (1) The Data Protection Board may grant a permission for the processing of personal data, as referred to in section 8(1)(9), if the processing is necessary, otherwise than in an individual case, in order to protect the vital interests of the data subject, or in order to use the public authority of the controller or a third person to whom the data is to be disclosed. The permission may be granted also in order to realise a legitimate interest of the controller or the recipient of the data, provided that such processing does not compromise the protection of the privacy of the individual or his/her rights. (2) The Data Protection Board may grant a permission for the processing of sensitive data, as referred to in section 12(13), for a reason pertaining to an important public interest. (3) The permission may be granted for a fixed period or for the time being; it shall contain the rules necessary for the protection of the privacy of the data subject. These rules may be amended or supplemented at the request of the Data Protection Ombudsman or the data subject, if this is necessary owing to a change in circumstances. Section 44 — Orders of the Data Protection Board At the request of the Data Protection Ombudsman, the Data Protection Board may: (1) prohibit processing of personal data which is contrary to the provisions of this Act or the rules and regulations issued on the basis of this Act; (2) in matters other than those referred to in section 40(2), compel the person concerned to remedy an instance of unlawful conduct or neglect; (3) order that the operations pertaining to the file be ceased, if the unlawful conduct or neglect seriously compromise the protection of the privacy of the data subject or his/her interests or rights, provided that the file is not set up under a statutory scheme; and