Data Protection [No. 3 of 2021 111 PART VII EXEMPTIONS FROM PRINCIPLES AND RULES OF PROCESSING OF DATA 39. A data controller that processes personal data in the interests of national security, defence and public order is exempt from the provisions of part IV, except for section 12 (1) (c), (d), (e) and (g). National security, defence and public order 40. (1) The processing of personal data in the interests of prevention, detection, investigation and prosecution of an offence or any other contravention of law shall not be permitted unless it is authorised by a written law and is necessary for, and proportionate to, such interests being achieved. Prevention, detection, investigation and prosecution of contraventions of law (2) Processing authorised by law under subsection (1) shall be exempt from the provisions of Part IV, except section 12 (1) (c), (d), (e) and (g). (3) A data controller shall not retain personal data processed under subsection (1) once the purpose of prevention, detection, investigation or prosecution of an offence or other contravention of law is complete except where that personal data is necessary for the maintenance of any record or database which constitutes a proportionate measure to prevent, detect, investigate or prosecute an offence or class of offences in future. 41. (1) Where processing of personal data is necessary for enforcing a legal right or claim, seeking a relief, defending a charge, opposing a claim, or obtaining legal advice from a legal practitioner in an impending legal proceeding, that processing shall be exempt from the provisions of Part IV except section 12 (1) (c), (d), (e) and (g). Processing for purposes of legal proceedings (2) Where processing of personal data by a court or tribunal is necessary for the exercise of any judicial function, that processing is exempt from the provisions of part IV except section 12 (1) (c), (d), (e) and (g). 42. (1) Where processing of personal data is necessary for research, archiving, or statistical purposes, that processing is exempt from the provisions of Part IV, except section 12 (1)(c), (d), (e) and (g). (2) Despite subsection (1), where sensitive personal data is being processed for research purposes that relate to scientific or historical research by a person other than a public body, that person shall not process such sensitive personal data without the authorisation of the Data Protection Commisioner. (3) Where personal data is being processed for scientifc research purposes by a person other than a public body, that person shall ensure that the personal data is anonymised Research, archiving or statistical purposes