8 (2) The duty of providing information, referred to above in paragraph (1), may be derogated from: (1) if the data subject already has the relevant information; (2) if this is necessary for the protection of national security, defence or public order or security, for the prevention or investigation of crime or for carrying out the monitoring function pertaining to taxation or the public finances; or (3) where the data are collected from elsewhere than the data subject, if the provision of the information to the data subject is impossible or unreasonably difficult, or if it significantly damages or inconveniences the data subject or the purpose of the processing of the data and the data are not used when making decisions relating to the data subject, or if there are specific provisions in an Act on the collection, recording or disclosure of the data. Section 25 — Information on the processing of data in certain situations (1) A controller shall provide the data subject with the data contained in the credit data file and pertaining to the data subject, as well as with the information on the controller and the processing referred to in section 24, at the time when the first entry on the data subject under section 20 has been recorded into the file. (2) Anyone who has obtained personal credit data on the data subject for the purpose of making a decision pertaining to the data subject shall notify the data subject of the use of the credit data in the decision-making, of the file from which the data have been obtained, of the time when the data have been obtained, if the rejection of credit or another decision negative from the point of view of the data subject is based on the credit data. (3) Where the name and contact information of an individual have been obtained from a personal data file for the purposes of direct marketing, distance selling or other direct advertising, or of market research or an opinion poll, or for a comparable addressed delivery, the file used, the controller and the address of the controller shall be mentioned. A teleseller shall give the same information upon request. Section 26 — Right of access (1) Regardless of secrecy provisions, everyone shall have the right of access, after having supplied sufficient search criteria, to the data on him/her in a personal data file, or to a notice that the file contains no such data. The controller shall at the same time provide the data subject with information of the regular sources of data in the file, on the uses for the data in the file and the regular destinations of disclosed data. Where an automated decision referred to in section 31 is involved, the data subject shall also have the right of access to information on the operating principles of the pertinent automatic processing of data. (2) A controller engaged in credit data activity shall upon the request of the data subject provide information on the recipients and destinations of personal credit data on the data subject disclosed during the preceding six months, as well as the sources of the data on the data subject. (3) The controller may charge for the provision of access to the data only if less than one year has passed since the previous instance of providing the data subject with access to data in the file. The charge shall be reasonable and it shall not exceed the immediate costs of providing access to the data. Section 27 — Restrictions on the right of access (1) There is no right of access, as referred to in section 26 above: (1) if providing access to the data could compromise national security, defence or public order or security, or hinder the prevention or investigation of crime; (2) if providing access to the data would cause serious danger to the health or treatment of the data subject or to the rights of someone else; (3) if the data in the file are used solely for historical or scientific research or statistical purposes; or (4) if the personal data in the file are used in the carrying out of monitoring or inspection functions and not providing access to the information is indispensable in order to safeguard an important economic interest or financing position of Finland or the European Union.