9 c) the purpose of the processing, and d) to which recipients or categories of recipients the information is disclosed. An application under the first paragraph shall be made in writing to the controller of personal data and be signed by the applicant him/herself. Information under the first paragraph shall be provided within one month from when the application was made. However, if there are special reasons for so doing, the information may be provided not later than four months after when the application was made. Information under the first paragraph does not need to be provided about personal data in running text that has not been given its final wording when the application was made or which comprises an aide memoire or the like. However, that stated here does not apply if the data has only been disclosed to a third party or if the data was only processed for historical, statistical or scientific purposes or, as regards running text that has not been given its final wording, if the data has been processed for a longer period than one year. Exemptions from the obligation to provide information in the case of secrecy and duty of confidentiality Section 27 To the extent that it is specifically prescribed by a statute or other enactment or by a decision that has been issued under an enactment that information may not be provided to the registered person, the provisions of Sections 23–26 do not apply. A controller of personal data who is not an authority may in that connection in a corresponding case as referred to in the Secrecy Act (1980:100) refuse to provide information to the registered person. Rectification Section 28 The controller of personal data is liable at the request of the registered person to immediately rectify, block or erase such personal data that has not been processed in accordance with this Act or regulations that have been made under the Act. The controller of personal data shall also notify a third party to whom the data has been disclosed about the measure, if the registered person requests it or if more substantial damage or inconvenience for the registered person could be avoided by a notification. However, no such notification need be provided if it is shown to be impossible or would involve a disproportionate effort. Automated decisions Section 29 If a decision that has legal effects for a natural person or otherwise has manifest effects for the natural person, is based solely on automated processing of such personal data as is intended to assess the qualities of the person, the person who is affected by the decision shall have an opportunity to have the decision reconsidered by a person upon request. Anybody who has been the subject of such a decision as is referred to in the first paragraph is entitled to on application obtain information from the controller of personal data about what has controlled the automated processing that resulted in the decision. As regards applications and provision of information, the applicable parts of the rules under Section 26 apply.