be disclosed and the length of time the data are to be stored.
4 – Processing whose sole purpose is the keeping of a register which according to laws or
regulations is intended to provide information to the public and which is open to
consultation by the public in general or by any person demonstrating a legitimate interest
shall be exempted from notification.
5 – The non-automatic processing of the personal data provided for in Article 7 (1) shall
be subject to notification when they are processed under 3 (a) of that Article.
(a) the processing of personal data referred to in Article 7 (2) and Article 8 (2);
(b) the processing of personal data relating to credit and the solvency of the data subjects;
(c) the combination of personal data provided for in Article 9;
(d) the use of personal data for purposes not giving rise to their collection.
2 – The processing referred to in the previous number may be authorised by legal ruling,
in which case it does not require the authorisation of the CNPD.
Applications for opinions, authorisation and notifications submitted to the CNPD shall
include the following information:
(a) the name and address of the controller and of his representative, if any;
(b) the purposes of the processing;
(c) a description of the category or categories of data subjects and of the data or categories
of personal data relating to them;
(d) the recipients or categories of recipients to whom the data might be disclosed and in
what circumstances;
(e) the body entrusted with processing the information, if it is not the controller himself;
(f) any combinations of personal data processing;
(g) the length of time for keeping personal data;
(h) the form and circumstances in which the data subjects may be informed of or may
correct the personal data relating to them;
i) proposed transfers of data to third countries;
j) a general description enabling a preliminary assessment to be made of the adequacy of
the measures taken under Articles 14 and 15 to ensure security of processing.
1 – The legal provisions referred to in Article 7 (2) and Article 8 (1) and the authorisations
of the CNPD and personal data filing systems must indicate at least:
15/20