1. The controller shall make available to the data subject at least the following information:

(a) the identity and the contact details of the Union body, office or agency;

(b) the contact details of the data protection officer;

(c) the purposes of the processing for which the operational personal data are intended;

(d) the right to lodge a complaint with the European Data Protection Supervisor and his or her contact details;

(e) the existence of the right to request from the controller access to and rectification or erasure of operational personal data and restriction of processing of the operational personal data concerning the data subject.

2. In addition to the information referred to in paragraph 1, the controller shall give to the data subject, in the specific cases foreseen by Union law, the following further information to enable the exercise of his or her rights:

(a) the legal basis for the processing;

(b) the period for which the operational personal data will be stored, or, where that is not possible, the criteria used to determine that period;