3388 GOVERNMENT GAZETTE the presentation of the results of the research. In the latter case, the results shall undergo pseudonymisation before being published. Article 31 Information to be provided where personal data are collected from the data subject 1. The obligation to inform the data subject pursuant to Article 13(3) of the GDPR shall not apply, with the exception of the exemption referred to in Article 13(4) of the GDPR where the information to be provided on further processing: (a) concerns further processing of data stored in a written form in which the controller directly addresses the data subject, the purpose is compatible with the original purpose of collection in accordance with the GDPR, communication with the data subject is not in digital form and the interest of the data subject in being informed according to the circumstances of the case, in particular as regards the context in which the data have been collected, is not deemed to be high; (b) in the case of a public body, would compromise the proper performance of the controller’s tasks within the meaning of points (a) to (e) of Article 23(1) of the GDPR, and the interest of the controller in not providing information overrides the data subject’s interest; (c) would compromise national or public security, and the interest of the controller in not providing information overrides the data subject’s interest; (d) would prevent the establishment, exercise or defence of legal claims, and the interest of the controller in not providing information overrides the interest of the data subject; (e) would compromise the confidentiality of the data transfer to public bodies. 2. Where no information is given to the data subject in accordance with paragraph 1, the controller shall take appropriate measures to protect the data subject’s legitimate interests, including the provision to the public of the information referred to in Article 13(1) and (2) of the GDPR in an accurate, transparent, intelligible and easily accessible form, in clear and plain language. The controller shall state in writing the reasons for forgoing the provision of information. The above subparagraphs shall not apply to indents (d) and (e) of the previous paragraph. 3. Where no notification is given in the cases referred to in paragraph 1 due to a temporary obstacle, the controller, taking into account the specific conditions of the processing, should comply with the obligation to provide information within a reasonable period of time after the obstacle has been removed, but not later than a period of two (2) weeks. 4. If, at the start of a mandate or in the course of a mandate, the customer disclosed data of third parties to an entity bound by an obligation of professional secrecy, the transmitting entity shall not be required to provide information to the data subject in accordance with Article 13(3) of the GDPR, unless the interest of the data subject in obtaining the information is overriding. Article 32 Information to be provided where the personal A’ 137/29.08.2019 data have not been obtained from the data subject 1. The obligation to inform the data subject in accordance with Article 14(1), (2) and (4) of the GDPR shall not apply where the provision of information: (a) in the case of public bodies: (aa) would compromise the proper performance of the controller’s tasks within the meaning of points (a) to (e) of Article 23(1) of the GDPR, or (bb) would compromise national or public security; and, therefore, the data subject’s interest in obtaining the information recedes, (b) in the case of private bodies: (aa) would prejudice the establishment, exercise or defence of legal claims, or the processing includes personal data resulting from contracts established under private law and is aimed at preventing damages caused by criminal offences, unless the data subject has an overriding legitimate interest in obtaining the information; or (bb) the competent public authority has specified to the controller that the publication of the data would compromise national defence, national security and public security, while in the case of data processing for law enforcement purposes, specification pursuant to the first subparagraph is not required. 2. Where no information is provided to the data subject in accordance with paragraph 1, the controller shall take appropriate measures to protect the data subject’s legitimate interests, including the provision to the public of the information referred to in Article 14(1) and (2) of the GDPR in an accurate, transparent, intelligible and easily accessible form, in clear and plain language. The controller shall state in writing the reasons for which he or she has refrained from providing information. 3. The obligation to provide information to the data subject in accordance with Article 14(1) to (4) of the GDPR, with the exception of exemptions referred to in Article 14(5) of the GDPR, shall not apply insofar as, by fulfilling this obligation, information would be disclosed which by its nature, in particular due to overriding legitimate interests of third parties, should remain confidential. Article 33 Right of access by the data subject/Communication of a personal data breach to the data subject 1. In addition to the exemptions laid down in Article 29(2) and Article 30(2), the right of access by the data subject in accordance with Article 15 of the GDPR shall not apply, where: (a) the data subject is not informed in accordance with point (bb) of indents (a) and (b) of paragraph 1 of the previous Article; or (b) the data (aa) were recorded only because they cannot be erased due to retention requirements provided for in legal or regulatory provisions, or (bb) only serve purposes of protection or control of data, and the provision of information would require a disproportionate effort, and the necessary technical and organisational measures render impossible their processing for other purposes.