Cyber Security and Data Protection (f) 16 other information dependent on the specific nature of the processing, as specified by the Authority. Disclosures when not collecting data directly from data subject (1) Where the data is not collected from the data subject, the controller or his or her representative shall provide the data subject with at least the information set out below when recording the data or considering communication to a third party, unless it is established that the data subject is in receipt of such information— (a) the name and address of the controller and of his or her representative, if any; (b) the purposes of the processing; (c) whether compliance with the request for information is compulsory or not, as well as what the consequences of the failure to comply are; (d) the existence of the right to object, by request and free of charge, to the intended processing of data relating to him or her, if it is obtained for the purposes of direct marketing; in which case, the data subject shall be informed prior to the first disclosure of the data to a third party or prior to the first use of the data for the purposes of direct marketing on behalf of third parties; (e) taking into account the specific circumstances in which the data is collected, any supporting information, as necessary to ensure fair processing such as— (i) the categories of data concerned; (ii) the recipients or categories of recipients of the data; (iii) the existence of the right to access and rectify the data relating to him/her, unless such additional information, taking into account the specific circumstances in which the data is provided, is not necessary to guarantee fair processing with respect to the data subject; (f) other information dependent on the specific nature of the processing, which is specified by the Authority. (2) The provisions of subsection (1) shall not apply where— (a) informing the data subject proves impossible or would involve a disproportionate effort, in particular for data collected for statistical purposes or for the purpose of historical or scientific research, or for the purpose of medical examination of the population with a view to protecting and promoting public health; or (b) data is recorded or provided in terms of the law. 5 10 15 20 25 30 35 (3) The Authority shall establish the conditions for the application of this section. 17 Authority to process Any person having access to the data and acting under the authority of the controller or of the processor, as well as the processor himself or herself, may process data only as instructed by the controller, without prejudice to any duty imposed by law. 18 40 Security (1) In order to safeguard the security, integrity and confidentiality of the data, the controller or his or her representative, if any, or the processor, shall take the appropriate technical and organisational measures that are necessary to protect data from negligent 12 45