c) d) e) whether the data will be disclosed and if so, the identity of the recipient, the fact that the provision of data is voluntary, and any other circumstances that will enable the data subject to exercise his rights pursuant to this Act in the best possible way, such as information on the right to demand access to data, cf. section 18, and the right to demand that data be rectified, cf. sections 27 and 28. Notification is not required if there is no doubt that the data subject already has the information in the first paragraph. Section 20 Obligation to provide information when data is collected from persons other than the data subject A controller who collects personal data from persons other than the data subject shall on his own initiative inform the data subject of which data are being collected and provide such information as is mentioned in section 19, first paragraph, as soon as the data have been obtained. If the purpose of collecting the data is to communicate them to other persons, the controller may wait to notify the data subject until such disclosure takes place. The data subject is not entitled to notification pursuant to the first paragraph if a) the collection or communication of data is expressly authorized by statute, b) notification is impossible or disproportionately difficult, or c) there is no doubt that the data subject already has the information which shall be contained in the notification. When notification is omitted pursuant to litra b, the information shall nonetheless be provided at the latest when the data subject is contacted on the basis of the data. Section 21 Obligation to provide information in connection with the use of personal profiles When a person contacts the data subject or makes decisions to which the data subject is subject on the basis of personal profiles that are intended to describe behaviour, preferences, abilities or needs, for instance in connection with marketing activities, the controller shall inform the data subject of a) the identity of the controller, b) the categories of data which are being used, and c) the sources of the data. Section 22 Right to information regarding automated decisions If a decision has legal or another significant effects for the data subject and is based solely on automated processing of personal data, the data subject who is subject to the decision may demand that the controller give an account of the rules incorporated in the computer software which form the basis for the decision. Section 23 Exceptions to the right to information The right to access pursuant to sections 18 and 22 and the obligation to provide information pursuant to sections 19, 20 and 21 do not encompass data a) which, if known, might endanger national security, national defence or the relationship to foreign powers or international organizations, b) regarding which secrecy is required in the interests of the prevention, investigation, exposure and prosecution of criminal acts,