(2) (3) 19. (1) (2) (3) (4) 20. (1) (2) (3) (4) Where categories of personal data have been specified as sensitive personal data under sub-Article (1) of this Article, the Commission may specify any further grounds on which such specified categories may be processed, having regard to: (a) the risk of significant harm that may be caused to a data subject by the processing of such category of personal data; (b) the expectation of confidentiality attached to such category of personal data; (c) whether a significantly discernible class of data subjects may suffer significant harm from the processing of such category of personal data; and (d) the adequacy of protection afforded by ordinary provisions applicable to personal data. The Commission may specify other categories of personal data which require additional safeguards or restrictions. Processing of Personal Data of a Child Data of a child shall be processed in a manner that protects and advances the rights and best interests of the child. The data controller shall bear the burden of proof. The processing of a child’s personal data shall be lawful where and to the extent that: (a) consent is given or authorized by the parent or guardian or tutor of the child; or (b) processing is necessary to the child’s vitally important interest. The data controller shall make reasonable efforts to verify the age of the data subject and that consent is given or authorized by the parent or guardian of a child, taking into consideration available technology. Notwithstanding the provisions of sub-Article (1) – (3) of this Article, the processing of personal data of a child for the purposes of marketing, profiling, or merging of profiles shall not be allowed. The Principle of Fairness and Transparency Personal data shall be processed fairly and in a transparent manner. For the purpose of sub-Article (1) of this Article, the processing of personal data shall meet the following conditions: (a) The data controller or data processor shall take appropriate measures to provide any information relating to processing to the data subject; (b) The information shall be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language; (c) Processing shall not be done in a way that is unexpected or misleading to the data subject; or (d) Processing shall respect the right to be informed and be done in a manner which is clear, open and honest. Any information addressed specifically to a child as per the provisions of sub-Article (2) lit. (b) of this Article shall be given special attention. The data controller shall be under a duty to always provide the information stipulated in Article 34 of this Proclamation. 11