Article 3 PDPA
Changing the purpose of the processing of personal data in the context of the performance of a public task Exemption from the obligation to provide information

1. An administrator performing a public task shall not provide the information referred to in Article 13(3) of Regulation 2016/679 if the change in the purpose of the processing is for the performance of a public task and the non-performance of the obligation referred to in Article 13(3) of Regulation 2016/679 is necessary to achieve the purposes referred to in Article 23(1) of the Regulation, and the provision of such information:

1) will prevent or significantly impede the proper performance of a public task, and the interest or fundamental rights or freedoms of the data subject are not overridden by the interest resulting from the performance of that public task, or

2) will violate the protection of classified information.

2. In the case referred to in paragraph 1, the controller shall provide appropriate measures to protect the interest or fundamental rights and freedoms of the data subject.

3. The controller is obliged to inform the data subject, upon request, without undue delay, but no later than one month from the date of receipt of the request, of the grounds for failure to provide the information referred to in Article 13(3) of Regulation 2016/679