What Needs to be Done Prior to Collection

Contact the data subject

Contact the Data Protection Board

Section 23

If data about a person is collected from the person him/herself, the controller of personal data shall in conjunction therewith voluntarily provide the registered person with information about the processing of the data.

Section 24

If personal data has been collected from another source than the registered person, the controller of personal data shall voluntarily provide the registered person with information about the processing of the data when it is registered. However, if the data is intended to be disclosed to a third party, the information need not be given before the data has been disclosed for the first time.

Information under the first paragraph need not be provided if there are provisions concerning the registration or disclosure of personal data in an act or some other enactment.

Nor need information be provided in accordance with the first paragraph, if it proves to be impossible or would involve a disproportionate effort. However, if the data is used to take measures concerning the registered person, the information shall be provided at the latest in conjunction with that happening.

Section 25

Information under Section 23 or 24 shall comprise

a) information concerning the identity of the controller of personal data,

b) information concerning the purpose of the processing, and

c) all other information necessary in order for the registered person to be able to exercise his/her rights in connection with the processing, such as information about the recipients of the information, the obligation to provide information and the right to apply for information and obtain rectification.

However, information need not be provided regarding such matters as the registered person already knows of.

Contact the Data Protection Board

Notification to the supervisory authority

Notification Duty

Section 36

Processing of personal data that is completely or partially automated is subject to a notification duty. The controller of personal data shall provide a written notification to the supervisory authority before such processing or a set of such processing with the same or similar purpose is conducted.

If the controller of personal data appoints a personal data representative, this shall be notified to the supervisory authority. Removal from office of a personal data representative shall also be notified to the supervisory authority.

The Government or the authority appointed by the Government may issue regulations concerning exemptions to the notification duty under the first paragraph for such kinds of processing as would probably not result in an improper intrusion of personal integrity.

Notification need not be made if there is a personal data representative

Section 37

Notification under Section 36, first paragraph, need not be made if the controller of personal data has given notice to the supervisory authority that a personal data representative has been appointed and who he/she is.