(1) Where two or more data controllers jointly determine the purposes and means of processing of personal data, they shall be joint data controllers. (2) Joint data controllers shall determine in their contracts their responsibilities, the scope of their obligations and the contact points for data subjects. CHAPTER SIX EXEMPTION AND ADMINISTRATION OF JUSTICE 63. (1) General Exemptions No exception to this Proclamation shall be allowed except where it constitutes a necessary and proportionate measure in a democratic society for: (a) (2) subject to sub-Article (4) of this Article, the protection of national security, defence or public security; (b) the prevention, investigation, detection or prosecution of an offence, including the execution of a penalty; (c) an objective of general public interest, including an economic or financial interest of the State; (d) the protection of judicial independence and judicial proceedings; or (e) the protection of a data subject or the rights and freedoms of others. The processing of personal data for the purpose of historical, statistical or scientific research may be exempt from the provisions of this Proclamation where the data protection principles, rights of data subject and obligations put on data controllers and data processors, and the security and organizational measures specified in Article 26 sub-Article (4), (5) and (6) of this Proclamation are implemented to protect the rights and freedoms of data subjects involved. (3) Personal data shall be exempt from any provision of this Proclamation where the nonapplication of such provision would, in the opinion of the Prime Minister, be required for the purpose of safeguarding national security, defence or public security. (4) A certificate under the hand of the Prime Minister certifying that the non-application of the provision is required for the purpose of safeguarding national security, defence or public security shall be conclusive evidence of that fact. (5) Notwithstanding what is stipulated under sub-Article (4) and (5) of this Article, (a) The certificate shall be limited in time, clearly specify the personal data category, the purpose of the processing, the safeguards that are put in place, the identity of the data controllers, data processors and the data subject; and (b) The decision shall be subject to independent review by the House. 64. Enforcement Order (1) Where the Commission is of the opinion that a data controller or a data processor has contravened, is contravening or is about to contravene this Proclamation, the 28