S21 (c) important economic and financial interests of the State or a public body; (d) fostering compliance with legal provisions established in the interests referred to under paragraphs (b) and (c); (e) historical, statistical or research purposes, and the data controller has established appropriate safeguards against the personal data being used for any other purposes or; (f) the legitimate interests of individual or public, relating to health or protection of life or environmental safety. (3) The Commission may impose reasonable conditions in respect of any authorisation issued under subsection (1). Exemption for processing of personal data for historical, statistical and research purposes 31. (1) The processing of personal information for historical, statistical and research purposes is exempt from all of the information protection principles except – (a) the principle regulating security safeguards; (b) the principle regulating information quality; or (c) the principle regulating de-identification of data for research purposes. (2) The data controller shall establish appropriate safeguards against the use of the data for any other purpose. PART V TRANS-BORDER FLOW OF PERSONAL INFORMATION OUTSIDE ESWATINI Transfer of personal information within SADC Member States 32. (1) Personal information shall only be transferred to recipients in a Member State that has transposed the SADC data protection requirements – (a) where the recipient establishes that the data is necessary for the performance of a task carried out in the public interest or pursuant to the lawful functions of a data controller, or (b) where the recipient establishes the necessity of having the data transferred and there is no reason to assume that the data subject’s legitimate interests might be prejudiced by the transfer or the processing in the Member State. (2) The controller shall, notwithstanding subsection (1), be required to make a provisional evaluation of the necessity for the transfer of the data. (3) The recipient shall ensure that the necessity for the transfer of the data can be subsequently verified. (4) The data controller shall ensure that the recipient shall process the personal information only for the purposes for which they were transferred.