Duty to provide information on the collection of sensitive personal data and personality profiles
1 The controller of the data file is obliged to inform the data subject of the collection of sensitive personal data or personality profiles; this duty to provide information also applies where the data is collected from third parties.
2 The data subject must be notified as a minimum of the following:
a. the controller of the data file;
b. the purpose of the processing;
c. the categories of data recipients if a disclosure of data is planned.
3 If the data is not collected from the data subject, the data subject must be informed at the latest when the data is stored or if the data is not stored, on its first disclosure to a third party.
4 The duty of the controller of the data file to provide information ceases to apply if the data subject has already been informed or, in cases under paragraph 3, if:
a. the storage or the disclosure of the data is expressly provided for by law; or
b. the provision of information is not possible or possible only with disproportionate inconvenience or expense.
5 The controller of the data file may refuse, restrict or defer the provision of information subject to the requirements of Article 9 paragraphs 1 and 4.