261 PART III - PROTECTION OF PERSONAL INFORMATION Frocessing of personal information 15. (1) The processing of personal information shall be automated, processed and kept in - (2) (a) a (b) electronic form. filing cabinet; and Personal information shall be processed (a) if - the data subject provides expticit consent to the pr.ocessing; (b) processing is necessary for the conclusion ot performance of a contract to which the data subject is a party; (c) processing is necessary for compliance with a legal obligation to which the data controller is subject; (d) processing is necessaly to protect the legitimate interests of the data subject; (e) processing is necessary for the proper pelformance of a public law duty by a public body; or (D processing is necessary for pursuing the legitimate in_ terests of the data contloller or of a third party to whom the infolmatiou is supplied. (2) A data subject may, on compelling legitimate grouncls, raise a written objection to the processing of data relating to him on the grounds listed in subsection (1) with the commission, and where the objection is upheld by the Commission, the data controller shali not process the data. Minimality 16. Personal information may only be plocessed if, given the purpose for