(3) The Authority may can exempt certain categories from notification under this section article if: (a) taking into account the data being processed, there is no apparent risk of infringement of the data subjects' rights and freedoms, and if the purposes of the processing, the categories of data being processed, the categories of data subjects, the categories of recipients and the data retention period are specified. (b) (i) The data controller has appointed a data protection officer. (ii) The appointment of the data protection officer shall be duly notified to the Authority. (iii) The data protection officer shall:  be a person who shall have the qualifications required to perform his/her duties;  keep a list of the processing carried out, which is immediately accessible to any person applying for access, and may not be sanctioned by his/her employer as a result of performing his/her duties. (iv) He/she may apply to the Authority when he/she encounters difficulties in the performance of his/her duties. (v) In case of non-compliance with the provisions of this law, the Authority shall order the data controller to carry out the formalities provided for in previous paragraph (1). (vi) In case of breach of his/her duties, the representative shall be discharged from his/her functions upon the demand, or after consultation, of the Authority. (vii) The Authority establishes the specific rules establishing the function of data protection officer. (4) If exemption from the duty of notification has been granted for automatic processing in accordance with the paragraph 1 previous paragraph, the data controller may must disclose the items of information mentioned in section 27 to any person entitled to receive such information. Draft Data Protection Bill Version 1.0 36