complied with subsection (2) in respect of the second or subsequent collection. 23. Accuracy of personal data A data controller shall take all reasonable steps to ensure that personal data within his possession is - 24. (a) accurate; and (b) kept up to date where such data requires regular updating. Processing of personal data (1) No personal data shall be processed, unless the data controller has obtained the express consent of the data subject. (2) Notwithstanding subsection (1), personal data may be processed without obtaining the express consent of the data subject where the processing is necessary (a) for the performance of a contract to which the data subject is a party; (b) in order to take steps required by the data subject prior to entering into a contract; (c) in order to protect the vital interests of the data subject; (d) for compliance with any legal obligation to which the data controller is subject; (e) for the administration of justice; or (f) in the public interest.