data fiduciary and the data principal, or would involve a disproportionate effort on the part of the data fiduciary due to the nature of the processing activities under this section. 17. Processing of data for reasonable purposes. — (1) In addition to the grounds for processing contained in section12 to section 16, personal data may be processed if such processing is necessary for such reasonable purposes as may be specified after taking into consideration— (a) (b) (c) (d) (e) (2) For the purpose of sub-section (1), the Authority may specify reasonable purposes related to the following activities, including— (a) (b) (c) (d) (e) (f) (g) (3) the interest of the data fiduciary in processing for that purpose; whether the data fiduciary can reasonably be expected to obtain the consent of the data principal; any public interest in processing for that purpose; the effect of the processing activity on the rights of the data principal; and the reasonable expectations of the data principal having regard to the context of the processing. prevention and detection of any unlawful activity including fraud; whistle blowing; mergers and acquisitions; network and information security; credit scoring; recovery of debt; processing of publicly available personal data; Where the Authority specifies a reasonable purpose under sub-section (1), it shall: (a) (b) lay down such safeguards as may be appropriate to ensure the protection of the rights of data principals; and determine where the provision of notice under section 8 would not apply having regard to whether such provision would substantially prejudice the relevant reasonable purpose. CHAPTER IV GROUNDS FOR PROCESSING OF SENSITIVE PERSONAL DATA 18. Processing of sensitive personal data based on explicit consent. — (1) Sensitive personal data may be processed on the basis of explicit consent. 11