Personal Data Protection Act GN. NO. 395B (Contd) Prohibition on processing of sensitive personal data 30.-(1) A person shall not process sensitive personal data without obtaining prior written consent of the data subject. (2) The consent under subsection (1) may be withdrawn by the data subject at any time and without any explanation or charges. (3) The Minister may, by regulations, determine circumstances in which the prohibition to process the personal data referred to in this section cannot be removed even with the data subject’s consent. (4) Where the data subject from whom consent is sought for the purpose of this Act, is a minor, a person of unsound mind or any other person unable to consent, such person’s consent shall be sought from his parents, guardian, heirs, attorneys or any other person recognised by law to be acting on behalf of the person whose consent is to be sought. (5) Subsection (1) shall not apply where(a) the processing is necessary for compliance with other written laws; (b) the processing is necessary to protect the vital interests of the data subject or of another person, where the data subject is incapable of giving his consent or is not represented by his legal representative; (c) the processing is necessary for the institution, trial or defence of legal claims; (d) the processing relates to personal data which has apparently been made public by the data subject; (e) the processing is necessary for the purposes of scientific research and the Commission has, by special guidelines, specified the circumstances under which such processing may be carried out; or (f) the processing is necessary for the purposes of medical reasons in the interest of the data subject, and the sensitive personal data 19