e. that is necessary for scientific research and carried out under the conditions established by the King in a decree agreed upon in the Council of Ministers after advice of the Commission for the protection of privacy. § 3. Persons authorised on the basis of § 2 to process personal data referred to in § 1 shall be obliged to secrecy. § 4. The King shall lay down in an decree agreed upon in the Council of Ministers after advice of the Commission for the protection of privacy, the specific conditions, with which the processing of the personal data referred to in § 1 Article has to comply. Chapter III - Rights of the data subject. Article 9 § 1. If personal data are obtained directly from the data subject, the controller or his representative shall provide the data subject no later than the moment on which the data are obtained, with at least the following information, unless he already has it: a. name and address of the controller and, if such is the case, of his representative; b. the purposes of the processing; c. the existence of a right to object on request and free of charges against the intended processing, if personal data are obtained for purposes of direct marketing; d. other additional information, in particular: • • • the recipients or categories of recipients of the data, whether or not replies to the questions are obligatory as well as possible consequences of a failure to reply, the existence of the right of access to and the right to rectify the personal data concerning him, unless such additional information is not necessary to guarantee fair processing towards the data subject, taking into account the specific circumstances in which the data are obtained. a. further information, dependent on the specific nature of the processing, that will be specified by the King after advice of the Commission for the protection of privacy. § 2. If personal data are not obtained from the data subject, the controller or his representative shall at the time of undertaking the recording of personal data or, if a communication to a third party is envisaged, no later than the moment on which the data are first disclosed, provide the data subject with at least the following information, unless he already has it: a. name and address of the controller and, if such is the case, of his representative; b. the purposes of the processing; c. the existence of a right to object on request and free of charges against the intended processing, if personal data are obtained for purposes of direct marketing; in that case, the data subject has to be informed before the personal data are for the first time disclosed to a third party or used for purposes of direct marketing on behalf of third parties; d. other additional information, in particular: • • • the recipients or categories of recipients of the data, whether or not replies to the questions are obligatory as well as possible consequences of a failure to reply, the existence of the right of access to and the right to rectify these data, 8