(iii) in the public interest, to safeguard public security or national security. (c) the transfer is made on such terms as may be approved by the Commissioner as ensuring the adequate safeguards for the protection of the rights of the data subject. (3) For the purpose of subsection (2)(c), the adequacy of the level of protection of a country shall be assessed in the light of all the circumstances surrounding the data transfer, having regard in particular to (a) the nature of the data; (b) the purpose and duration of the proposed processing; (c) the country of origin and country of final destination; (d) the rules of law, both general and sectoral, in force in the country in question; and (e) any relevant codes of conduct or other rules and security measures which are complied with in that country. Amended by [Act No. 14 of 2009] 32. Data matching (1) No data controller shall carry out a data matching procedure unless – (a) (i) the data subject whose personal data is the subject to that procedure has given his consent to the procedure being carried out; (ii) the Commissioner has consented to the procedure being carried out; and (iii) is the procedure carried out in accordance with such conditions as the Commissioner may impose; or