3 The provisions on access to official documents apply to access to information in the personal data files of the authorities and to other disclosure of. personal data therein. Section 9 — Principles relating to data quality (1) The personal data processed must be necessary for the declared purpose of the processing (necessity requirement). (2) The controller shall see to that no erroneous, incomplete or obsolete data are processed (accuracy requirement). This duty of the controller shall be assessed in the light of the purpose of the personal data and the effect of the processing on the protection of the privacy of the data subject. Section 10 — Description of file (1) The controller shall draw up a description of the personal data file, indicating: (1) the name and address of the controller and, where necessary, those of the representative of the controller; (2) the purpose of the processing of the personal data; (3) a description of the group or groups of data subjects and the data or data groups relating to them; (4) the regular destinations of disclosed data and whether data are transferred to countries outside the European Union or the European Economic Area; and (5) a description of the principles in accordance to which the data file has been secured. (2) The controller shall keep the description of the file available to anyone. This obligation may be derogated from, if necessary for the protection of national security, defence or public order and security, for the prevention or investigation of crime, or for a supervision task relating to taxation or public finances. Chapter 3 — Sensitive data and personal identity number Section 11 — Prohibition to process sensitive data The processing of sensitive data is prohibited. Personal data are deemed to be sensitive, if they relate to or are intended to relate to: (1) race or ethnic origin; (2) the social, political or religious affiliation or trade-union membership of a person; (3) a criminal act, punishment or other criminal sanction; (4) the state of health, illness or handicap of a person or the treatment or other comparable measures directed at the person; (5) the sexual preferences or sex life of a person; or (6) the social welfare needs of a person or the benefits, support or other social welfare assistance received by the person. Section 12 — Derogations from the prohibition to process sensitive data (1) The prohibition in section 11 does not prevent: (1) processing of data where the data subject has given an express consent; (2) processing of data on the social, political or religious affiliation or trade-union membership of a person, where the person has himself/herself brought the data into the public domain; (3) processing of data necessary for the safeguarding of a vital interest of the data subject or someone else, if the data subject is incapable of giving his/her consent; (4) processing of data necessary for drafting or filing a lawsuit or for responding to or deciding of such a lawsuit; (5) processing of data where based on the provisions of an Act or necessary for compliance with an obligation to which the controller is subject directly by virtue of an Act; (6) processing of data for purposes of historical, scientific or statistical research; (7) the processing of data on religious, political or social affiliation in the operations of an association or corporation professing such affiliation, where the data relate to members of the association or corporation or to persons connected to the association or