[lemma=datum] □
[lemma=datum] □ □
[lemma=datum] [□]
A good system is generally characterized by a high degree of awareness among data controllers of their obligations , and among data subjects of their rights and the means of exercising them . Section 29 of the Act does provide exemptions from the requirement to inform data subjects of disclosures in certain specific circumstances if the disclosure is being made for the prevention or detection of crime , the apprehension or prosecution of offenders , or the assessment or collection of tax or duty . Also based on the directive is the requirement that upon first use of personal data for direct marketing purposes , a data user must inform the data subject of the opportunity to opt-out from further approaches . However , Section 29 of the Act does provide exemptions from the requirement to inform data subjects of disclosures in certain specific circumstances if the disclosure is being made for the prevention or detection of crime , the apprehension or prosecution of offenders , or the assessment or collection of tax or duty . A data controller who collects personal health data from persons other than the data subject shall on his own initiative inform the data subject of the data which are being collected and provide such information as is mentioned in section 23 , first paragraph , as soon as the data have been obtained . Any department or section that uses personal data for direct marketing purposes must inform data subjects of this at the time of collection of the data . However , these exemptions will only apply if informing the data subject of a disclosure , for example to the Police , would prejudice their enquiries . University Data Protection Officer who will have to consider / balance the impact on the third party of the disclosure , and the impact on the data subject of the disclosure being withheld . The HMIS user should strive to give notice to the affected data subjects of the access to their personal information , unless directed not to by a court . A printout of the data subject 's record should be delivered to the data subject on demand when and where the information is used . In cases where independent analysis could not be performed without knowing the identity of each data subject , a system would be considered fully " capable " if , for example , it had obtained the consent of each data subject to participate in a follow-on study , or had a policy of seeking the consent of data subjects on behalf of persons wanting to perform such independent analysis . An agreement may be made to forward a communication to a data subject on behalf of a third party , but no information should be disclosed about the data subject .