8
Information to the registered person
Information should be provided voluntarily
Section 23
If data about a person is collected from the person him/herself, the controller of personal data
shall in conjunction therewith voluntarily provide the registered person with information about
the processing of the data.
Section 24
If personal data has been collected from another source than the registered person, the
controller of personal data shall voluntarily provide the registered person with information
about the processing of the data when it is registered. However, if the data is intended to be
disclosed to a third party, the information need not be given before the data has been disclosed
for the first time.
Information under the first paragraph need not be provided if there are provisions concerning
the registration or disclosure of personal data in an act or some other enactment.
Nor need information be provided in accordance with the first paragraph, if it proves to be
impossible or would involve a disproportionate effort. However, if the data is used to take
measures concerning the registered person, the information shall be provided at the latest in
conjunction with that happening.
The information that must be provided voluntarily
Section 25
Information under Section 23 or 24 shall comprise
a) information concerning the identity of the controller of personal data,
b) information concerning the purpose of the processing, and
c) all other information necessary in order for the registered person to be able to exercise
his/her rights in connection with the processing, such as information about the recipients of
the information, the obligation to provide information and the right to apply for
information and obtain rectification.
However, information need not be provided regarding such matters as the registered person
already knows of.
Information shall be provided upon application
Section 26
The controller of personal data is liable to provide, to every natural person who requests it,
free of charge notification once per annum of whether personal data concerning the applicant
is processed or not. If such data is processed, written information shall also be provided about
a) which information about the applicant that is processed,
b) where this information has been collected,