Cyber Security and Data Protection in the interest of the data subject, and the data is processed under the supervision of a health professional. 5 (4) Health-related data may only be processed under the responsibility of a health-care professional, except if the data subject has given his or her written consent or if the processing is necessary for the prevention of imminent danger or for the mitigation of a specific criminal offence. (5) The Authority shall be entitled to specify the conditions under which such processing may be carried out. 10 (6) Health related data may only be collected from other sources where the data subject is incapable of providing the data. (7) For the purposes of processing personal information under this section, the health professional and his or her agents are subject to the duty of professional secrecy. 15 (8) The processing of genetic data, shall be authorised if it is processed for what it reveals or contains and data concerning health shall be processed only if a unique patient identifier is given to the patient which is distinct from any other identification number, issued by the public authority established for this purpose. (9) The association of the unique patient identifier with any other identifier which permits the identification of the data subject as provided for in section 8 is permissible only with the express authorisation of the Authority. (10) The data of a child shall be processed subject to section 26. 20 PART VI Duties of the Data Controller and Data Processor 15 25 30 35 40 Disclosures when collecting data directly from data subject (1) When obtaining data directly from the data subject, the controller or the controller’s representative shall provide the data subject with at least the following information, unless the data subject has already received such information— (a) the name and address of the controller and of his or her representative, if any; (b) the purposes of the processing; (c) the existence of the right to object, by request and free of charge, to the intended processing of data relating to him or her, if it is obtained for the purposes of direct marketing; (d) whether compliance with the request for information is compulsory or not, as well as what the consequences of the failure to comply are; (e) taking into account the specific circumstances in which the data is collected, any supporting information, as necessary to ensure fair processing for the data subject, such as— (i) the recipients or categories of recipients of the data; (ii) whether it is compulsory to reply, and what the possible consequences of the failure to reply are; (iii) the existence of the right to access and rectify the data relating to him or her except where such additional information, taking into account the specific circumstances in which the data is collected is not necessary to guarantee accurate processing. 11