A’ 137/29.08.2019 GOVERNMENT GAZETTE Article 50 Processing under the authority of the controller (Article 23 of the Directive) Any person acting under the authority of the controller or the processor, who has access to personal data, shall process such data on instructions from the controller, unless provided otherwise by law. Article 51 Confidentiality All persons employed in the processing of personal data shall process such data upon authorisation and shall be obliged, when taking up their duties, to maintain confidentiality. The obligation of confidentiality continues even after the termination of their employment. Article 52 Automated individual decision-making (Article 11 of the Directive) 1. A decision based solely on automated processing, which produces an adverse legal effect concerning the data subject or significantly affects him or her shall be permitted only if provided for by law. 2. Decisions referred to in the previous paragraph shall not apply to special categories of personal data, unless appropriate measures to safeguard the data subject’s legitimate interests are in place. 3. Profiling that results in discrimination against natural persons on the basis of special categories of personal data shall be prohibited. SECTION III RIGHTS OF THE DATA SUBJECT Article 53 General information on data processing (Articles 12 and 13 of the Directive) The controller shall provide general and easily accessible information to the public in plain and intelligible language through the website of the public authority with regard to: (a) the purposes of processing, (b) the right of the data subject to request from the controller access to, rectification, erasure or restriction of processing, (c) the identity and the contact details of the controller and the DPO, (d) the right to lodge a complaint with the Authority, and (e) the contact details of the Authority. Article 54 The data subject’s right to be informed (Article 13 of the Directive) 1. In specific cases, and in particular where the personal data of the data subject have been collected in secrecy and in order to enable the exercise of his or her rights, the data subject should, in addition to the information referred to in the previous Article, be informed, at least, of: (a) the legal basis for the processing; 3393 (b) the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period; (c) where applicable, the recipients of the personal data; (d) where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject. 2. In the cases referred to in the previous paragraph, the controller may delay, restrict or omit the provision of information to the data subject, if necessary, in order to: (a) enable the competent authorities to perform their duties, as described in Article 43, (b) ensure national security or public security, or (c) protect the legitimate interests of third parties, which would otherwise be threatened, if the interest in avoiding these threats overrides the interest of the data subject in being informed. 3. The provisions of paragraph 7 of the following Article shall also apply to the restrictions of the previous paragraph. Article 55 Right of access (Articles 14 and 15 of the Directive) 1. The controller shall, at the data subject’s request, inform the data subject of the processing of personal data relating to him or her. The data subject shall also be informed of: (a) the personal data to be processed and the categories to which they belong; (b) any available information on the data origin; (c) the purposes and legal basis for the processing; (d) the recipients or categories of recipients to whom the data have been disclosed, in particular recipients in third countries or international organisations; (e) the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period; (f) the possibility of exercising the right to rectification or erasure or restriction of the processing of personal data; (g) the right to lodge a complaint with the Authority, pursuant to Article 58; and (h) the contact details of the Authority. 2. The previous paragraph shall not apply to personal data which are processed only because they cannot be erased due to legal requirements for retention or for the sole purpose of data security or data protection audits, where the provision of information involves a disproportionate effort and the processing for other purposes through appropriate technical and organisational measures is excluded. 3. No information shall be provided if the data subject does not provide any information enabling his or her personal data to be found and, therefore, the effort involved is disproportionate to the interest of the data subject in being informed. 4. In the cases referred to in paragraph 2 of the previous Article, the controller may refuse to provide information in accordance with the first subparagraph of paragraph 1 or to restrict, in whole or in part, the provision of information in accordance with the second subparagraph of paragraph 1. 5. The data subject shall not be notified of the identity of