provision to or use at the account of third parties, the notification shall take place at least once a year. 4. Responsible parties processing personal data for the purposes referred to under (1), shall make sure that data subjects are notified of the possibility of registering objections, whenever a direct message is sent to them for the said purposes. Article 42 1. No one may be subject to a decision to which are attached legal consequences for them, or which affects them to a substantial degree, where this decision has been taken solely on the basis of the automated processing of personal data intended to provide a picture of certain aspects of their personality. 2. The provisions of (1) do not apply where the decision referred to therein: a. has been taken in connection with the conclusion or execution of a contract, and 1º. the request of the data subjects has been met, or 2º. appropriate measures have been taken to protect their legitimate interests; or b. is based on a law in which measures are laid down for protecting the legitimate interests of data subjects. 3. Appropriate measures, as referred to under (2)(a), shall be considered as taken where the data subjects have been given the opportunity to put forward their views on the decisions as referred to under (1). 4. In the case referred to under (2), the responsible party shall inform the data subjects about the underlying logic of the automated processing of the data relating to them. CHAPTER 7. EXCEPTIONS AND RESTRICTIONS Article 43 Responsible parties are not required to apply Articles 9(1), 30(3), 33, 34 and 35, where this is necessary in the interests of: a. State security; b. the prevention, detection and prosecution of criminal offences; c. important economic and financial interests of the State and other public bodies; d. supervising compliance with legal provisions established in the interests referred to under (b) and (c), or e. protecting the data subject or the rights and freedoms of other persons. Article 44