9 (2) If only a part of the data on a data subject is such that it falls within the restriction on the right of access provided in paragraph (1), the data subject shall have the right of access to the remainder of the data. Section 28 — Realisation of the right of access (1) Anyone who wishes to have access to the data on himself/herself, as referred to in section 26, shall make a request to this effect to the controller by a personally signed or otherwise comparably verified document or by appearing personally in the premises of the controller. (2) The controller shall without undue delay reserve the data subject an opportunity to inspect the data referred to in section 26 or, upon request, provide a hard copy of the data. The data shall be given in an intelligible form. If the controller refuses to provide access to the data, a written certificate to this effect shall be issued. The certificate shall also mention the reasons for the refusal. A failure by the controller to give a written response to the data subject within three months of the request is deemed equivalent to a refusal to provide access to the data. In this event, the data subject may bring the matter to the attention of the Data Protection Ombudsman. (3) Anyone who wishes to have access to the data on himself/herself in the files of the health care authorities and institutions, physicians and dentists or other health care professionals and relating to their state of health or illness, shall make a request to this effect to a physician or another health care professional, who shall then see to the obtainment of the data with the consent of the data subject and provide him/her with access to the entries in the file.. The provisions in paragraph (2) apply to the procedure in the realisation and refusal of the right of access. Section 29 — Rectification (1) The controller shall, on its own initiative or at the request of the data subject, without undue delay rectify, erase or supplement personal data contained in its personal data file and erroneous, unnecessary, incomplete or obsolete as regards the purpose of the processing. The controller shall also prevent the dissemination of such data, if this could compromise the protection of the privacy of the data subject or his/her rights. (2) If the controller refuses the request of a data subject of the rectification of an error, a written certificate to this effect shall be issued.The certificate shall also mention the reasons for the refusal. In this event, the data subject may bring the matter to the attention of the Data Protection Ombudsman. (3) The controller shall notify the rectification to the recipients to whom the data have been disclosed and to the source of the erroneous personal data. However, there is no duty of notification if this is impossible or unreasonably difficult. Section 30 — Right to prohibit processing A data subject has the right to prohibit the controller to process personal data for purposes of direct advertising, distance selling, other direct marketing, market research, opinion polls, public registers or genealogical research. Section 31 — Automated decisions The making of a decision on the basis of certain characteristics of a data subject, where involving solely automatised data processing and having legal consequences to the data subject or otherwise significantly affecting him/her, is permitted only if (1) so provided in an Act; or (2) the decision is made in connection with the making or performance of an agreement, provided that the protection of the rights of the data subject is guaranteed or that the decision fulfils the request of the data subject on the making or performance of the agreement.