(4) The Authority may, at any reasonable time during working hours, carry out further inspection and assessment of the security and organisational measures employed by a data controller subject to reasonable notification of the data controller. Authorization 28. (1) The Authority shall establish the categories of data processing which represent specific risks to the fundamental rights of the data subject and which require specific authorization from the Authority. (2) Such authorization shall only be provided following receipt of notification from the data controller or from the data protection officer pursuant to sections 26 and 27. Openness of the processing 29. (1) (a) The Authority shall keep a register of all automatic processing operations of personal data. (b) Any entry in the register must include the information mentioned in section 27. (c) The register shall be available for consultation/inspection by all members of the public, in the manner determined by the Authority. (2) In case of the processing of personal data exempted from notification by this Act, the Authority may, either by virtue of its office or at the data subject's request, impose upon the controller the obligation to disclose to the data subject all or part of the information mentioned in section 27. Accountabilit y 30. (1) The data controller shall: (a) take all the necessary measures to comply with the principles and obligations set out in this Act. and (b) have the necessary internal mechanisms in place for demonstrating such compliance to both the data subjects and to the Authority in the exercise of its powers. Draft Data Protection Bill Version 1.0 38