S20 (a) assess an application by a data subject in order to take a decision about, or provide a service to that data subject; or (b) protect their legitimate interests in relation to criminal offences which have been or can reasonably be expected to be committed against them or against persons in their service. (3) The processing of information concerning personnel in the service of the data controller shall take place in accordance with the rules established in compliance with the labour laws. (4) The prohibition on processing any of the categories of personal information referred to in this Part, shall not apply where such processing is necessary to supplement the processing of information on criminal behaviour permitted under this section. General exemption on sensitive personal information 29. Without prejudice to Sections 23 to 28, the prohibition on processing sensitive personal information shall not apply where – (a) processing is carried out with prior parental consent where the data subject is a child and is subject to parental control in terms of the law; (b) the processing is necessary for the establishment, exercise or defence of a right or obligation in law; (c) processing is necessary to comply with an obligation of international public law; (d) the Commission has granted authority in terms of section 30 for processing in the public interest, and appropriate guarantees have been put in place in law to protect the data subject’s privacy; (e) processing is carried out with the consent of the data subject; or (f) the information has deliberately been made public by the data subject. Authorisation by the Commission 30. (1) The Commission may authorise a data controller to process personal information, where the Commission is satisfied that, in the circumstances of the case (a) the public interest in the processing outweighs, to a substantial degree, any interference with the privacy of the data subject that could result from such processing; or (b) the processing involves a clear benefit to the data subject or a third party that outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing. (2) The public interest referred to in subsection (1)(a) includes – (a) the legitimate interests of State security; (b) the prevention, detection and prosecution of offences;