h. facilitate the objectives of scientific research should the data not be disclosed;
i. were conducted in respect of documents placed in archives.
(4) The data protection file is public, which the Authority shall publish on its website and guarantee
free access to.
Section 66
(1) The controller requests that the Authority registers the control of the personal data in a file, with
the exception of mandatory data control prior to launching the control process. The control process
cannot be launched prior to registration in the file, with the exception of mandatory data control and
the case specified in Section 68 (2).
(2) The controller may request the registration of mandatory data control in the file from the
Authority within a period of 20 days following the coming into force of the legislation regulating
mandating data control.
(3) In terms of registration, data controls with alternative objectives qualify as independent data
control even if the same set of data is controlled.
(4) The request for registration in the file must include the data specified in Section 65 (1) and (2).
Section 67
The administration service fee defined in the ministry decree must be paid to register the data
control in the data protection file, which does not apply to mandatory data control.
Section 68
(1) With the exception of the case defined in subsection (3), the Authority shall file the data control
within a period of eight days following the receipt of the request, should this request contain the
data specified in Section 65 (1) and (2).
(2) With the exception of the case defined in subsection (3), should the Authority fail to assess the
request for registration prior to the expiry of the deadline set, the controller is authorised to launch
data control in accordance with the content of the request submitted.
(3) The Authority shall register data control specified in subsection (4) and (5) within a period of 40
days following the receipt of the request, should the request contain the data specified in Section 65
(1) and (2) and the conditions for legitimate data control are ensured by the controller.
(4) Should the request concern data control registration - defined in subsection (5) – relating to data
files in which case data control by the controller registered previously has not been undertaken, or
not applied in the case of data control registered previously by the controller, this necessitates the
use of new data processing technology and ensuring the conditions for legitimate control by the
controller is a precondition for registration.
(5) In accordance with the conditions defined, the precondition for registration defined in subsection
(4) relate to
a. controlling national official, occupational and criminal data files;
b. data control concerning financial organisations and public utility service providers;
c. data control concerning clients using the services of electronic telecommunications service
providers.
(6) The decision issued by the Authority in respect of the authorisation of registration in the data
protection file must contain the data control registration number which the controller must indicate
in the case of each individual data transfer, disclosure and data made available to the data subject.
This registration number allows the data control to be identified and does not certify the legitimacy
of the control activity registered.
(7) In the event of changes to data specified under Section 65 Subsection (1)(b) - (j), the controller