68 annual report 2011 Authorities subject to Danish legislation Whether information is publicly available or not is of great importance to whether authorities may use it in a case. This follows from the rules in the Act on Processing of Personal Data (Act no. 429 of 31 May 2000). Pursuant to section 7(1) of the Act, information concerning racial or ethnic background, political, religious or philosophical conviction, trade union membership or health or sexual matters may not be processed. However, this rule does not apply to information made public by the person him- or herself (section 7(2)(3)). Similarly, it must be permitted to process personal information less sensitive than the information listed in section 7(1) freely if the information has been made public by the person him- or herself. In the Facebook case, the Ombudsman also had the opportunity to consider whether the standard terms and conditions unilaterally laid down by Facebook in the USA had any independent relevance to Danish administrative authorities’ handling of information on Facebook. This was not the case, as the author­ ities’ handling of personal information – also from Facebook – is governed by Danish public law. Even if information is publicly available, a public authority is not necessarily entitled to process it, as the provision in section 5 of the Act on Processing of Personal Data on good data processing practice also applies to information which has been made public. An authority is still only allowed to obtain and use information if obtaining and using such information is relevant and legitimate in relation to the case. The legitimacy requirement in section 5 must be understood in the same way as the general legitimacy requirements of administrative law in relation to case processing. With regard to the provision of evidence in a case, these requirements follow from the generally applicable evidential or inquisitorial principle, possibly supplemented by special statutory rules on evidence (such as the rules of the Tax Control Act) and the relevance requirement. According to the inquisitorial principle, the authority is responsible for providing sufficient evidence in the case for a sound and legal decision to be made. In other words: the information which an administrative authority may obtain and use is limited by what is legitimate and relevant according to the legislation within the specific area – and this also applies to publicly available information.