S10 (c) order that person or body or persons compensate to the benefit of an aggrieved person or data subject. Protection of Commission 7. The Commission, its employees or any person acting on behalf of or under the direction of the Commission shall not be civilly or criminally liable for anything done in good faith in the exercise or performance of any power, duty or function of the Commission in terms of this Act. Confidentiality 8. A person acting on behalf of or under the direction of the Commission shall treat as confidential, personal information which comes to their knowledge, except where the communication of such information is required by law or in the proper performance of their duties. PART III PROCESSING OF PERSONAL INFORMATION Processing of personal information 9. (1) The processing of personal information shall be processed and kept in – (a) a filing cabinet; and or (b) electronic form. (2) Personal information shall be processed if – (a) the data subject provides explicit consent to the processing; (b) processing is necessary for the conclusion or performance of a contract to which the data subject is a party; (c) processing is necessary for compliance with a legal obligation to which the data controller is subject; (d) processing is necessary to protect the legitimate interests of the data subject; (e) processing is necessary for the proper performance of public law duty by a public body; or (f) processing is necessary for pursuing the legitimate interests of the data controller or of a third party to whom the information is supplied. (3) A data subject, may, on compelling legitimate grounds, make a written objection to the processing of data relating to that data subject to the Commission on the grounds that the processing does not comply with the conditions listed in subsection (1) and where the objection is upheld by the Commission, the data controller shall not process the data. (4) Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.