b. public registers set up by law. Section 2. Prior investigation Article 31 1. The Data Protection Commission shall initiate an investigation prior to any processing for which responsible parties: a. plan to process a number identifying persons for a purpose other than the one for which the number is specifically intended with the aim of linking the data together with data processed by other responsible parties, unless the number is used for the cases defined in Article 24; b. plan to record data on the basis of their own observations without informing the data subjects thereof, or c. plan to process data on criminal behaviour or on unlawful or objectionable conduct for third parties other than under the terms of a licence issued under the Private Security Organisations and Investigation Bureaus Act. 2. The provisions of (1)(b) do not apply to public registers set up by law. 3. The provisions of (1) may be rendered applicable to other types of data processing by law or general administrative regulation where such processing carries a particular risk for the individual rights and freedoms of the data subject. The Data Protection Commission shall indicate in its annual report the extent to which, in its opinion, the said provisions should be rendered applicable to such data. 4. The Data Protection Commission shall notify processing referred to under (1)(c) to the European Commission. Article 32 1. Data processing to which Article 31(1) is applicable shall be notified as such by the responsible party to the Data Protection Commssion. 2. The notification of such data processing requires responsible parties to suspend the processing they are planning to carry out until the Commission has completed its investigation or until they have received notice that a more detailed investigation will not be conducted. 3. In the case of the notification of data processing to which Article 31(1) is applicable, the Commission shall communicate its decision in writing within four weeks of the notification as to whether or not it will conduct a more detailed investigation. 4. In the event that the Commission decides to conduct a more detailed investigation, it shall indicate the period of time within which it plans to conduct this investigation. This period must not exceed thirteen weeks. 5. The more detailed investigation referred to under (4) leads to a statement concerning the lawfulness of the data processing. 6. The statement by the Commission is deemed to be equivalent to a decision within the meaning of the General Administrative Regulations Act. This statement shall be prepared in accordance with the procedure laid down by Section 3.4 of that Act.