S13 (2) The further processing of personal information shall be compatible with the purposes of collection if – (a) the data subject has consented to the further processing of the information; (b) the information is available in public records or has deliberately been made public by the data subject; (c) further processing is necessary – (i) to avoid prejudice to the maintenance of the law or enforcement of law and order; (ii) for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; or (iii) in the legitimate interests of national security; (d) the further processing of the information is necessary to prevent or mitigate a serious and imminent threat to – (i) public health and safety; or (ii) the life and health of the data subject or another individual; (e) The information is used for historical, statistical or research purposes and the data controller has established appropriate safeguards against the personal data being used for any other purposes. Retention of records 13. (1) Subject to subsections (2) and (3), records of personal information shall not be retained any longer than a prescribed period unless – (a) retention of the record is required or authorised by law; (b) the data controller reasonably requires the record for lawful purposes related to its functions or activities; (c) retention of the record is required by a contract between the parties; or (d) the data subject has consented to the retention of the record. (2) Records of personal information may be retained for periods in excess of those contemplated in subsection (1) for historical, statistical or research purposes and the data controller has established appropriate safeguards against the personal data being used for any other purposes. (3) A data controller which or who has used a record of personal information of a data subject to make a decision about the data subject shall – (a) retain the record for such period as may be required or prescribed by law or a code of conduct; or