Article 9 — Right to Information About Processing

1. 1.

   Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

   1. All information specified in Article 8, paragraph 1.
   2. The categories of personal data concerned.
   3. The source from which the personal data originate, and where applicable, whether the data came from publicly accessible sources.
2. 2.

   The controller shall provide the information referred to in paragraph 1 within a reasonable period after obtaining the personal data, but at the latest within thirty days, having regard to the specific circumstances in which the personal data are processed. Where the personal data are to be used for communication with the data subject, the information shall be provided at the latest at the time of the first communication to that data subject. Where disclosure to another recipient is envisaged, the information shall be provided at the latest when the personal data are first disclosed.

3. 3.

   Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject, prior to that further processing, with information on that other purpose and with any relevant further information in accordance with paragraph 1.

4. 4.

   The provisions of paragraphs 1, 2, and 3 shall not apply where and insofar as:

   1. The data subject already has the information.
   2. The provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes. In such cases, the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available, and shall document the reasons for which it considers the effort disproportionate.
   3. Obtaining or disclosure of the data is expressly laid down by the law of the State to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests.
   4. The personal data must remain confidential subject to an obligation of professional secrecy regulated by the law of the State, including a statutory obligation of secrecy.
5. 5.

   The information required under this Article shall be provided in accordance with the form and accessibility requirements set out in Article 8, paragraphs 3 and 4.