Article 16 The right to complain 1. Every person who claims that his rights, freedoms and legal interests concerning his personal data have been violated shall have the right to complain or to notify the Commissioner and to request his intervention to remedy the infringed right. Following this complaint, in accordance with the Code of Civil Procedure, the data subject may file a complaint in court. 2. When the data subject has filed a complaint, the controller shall have no right to make any changes to the personal data until a final decision ruled. Article 17 Compensation of the damage Everyone who has suffered damage due to an unlawful processing of personal data is entitled to compensation, pursuant to the rules defined by the Civil Code. 22 CHAPTER V OBLIGATIONS OF THE CONTROLLER AND PROCESSOR Article 18 Obligation to Inform 1. The controller, when collecting personal data, shall inform the data subject on the scope and purpose for which personal data are being processed, the person who is going to process the data, on the mean of processing, except for when the data subject is already aware of such information. The controller shall inform the data subject on the right to access and the right to rectify the data concerning him. 2. In case the controller processes personal data obtained from the data subject, it is obliged to inform the data subject whether the provision of the personal data is obligatory or optional. If the data subject, under a legal or secondary act, is obliged to provide personal data for processing, the controller informs him on this fact as well as on the consequences of refusal to provide personal data. 3. The controller is not obliged to provide information and to inform when personal data are not obtained by the data subject, if: a) it processes personal data exclusively for the purpose of historical, statistical and scientific research and if provision of such information is not possible or demands disproportionate efforts; 23

Select target paragraph3