(6) Where the data subject withdraws consent for the processing of any personal data necessary for the performance of a contract to which he is a party, reasonable legal consequences for the effects of such withdrawal shall be borne by him. The withdrawal of consent by the data subject shall not affect the lawfulness of processing based on consent before its withdrawal. 17. (1) (2) Processing of Sensitive Personal Data The processing of sensitive personal data shall be prohibited. Notwithstanding the provision of sub-Article (1) of this Article, the processing of sensitive personal data shall be permitted in the following cases: (a) The data subject has given his written consent, specific to the purpose prior to the processing except where a law provides that the prohibition referred in sub-Article (1) of this Article may not be lifted by the data subject; (b) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his consent prior to the processing; (c) The processing is necessary to achieve the lawful and non-commercial objectives of public organizations; (d) The processing is necessary for purposes of medical treatment and is carried out by a medical treatment institution; (e) The processing concerns such personal data as is necessary for the protection of lawful rights and interests of persons in court proceedings, or other public institutions, or (f) processing is carried out in the course of its legitimate activities by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects. Sensitive personal data in respect of race or ethnic origin shall not be processed unless the processing is: (a) for ensuring justice and equality with regard to race or ethnic origin; and (b) carried out with appropriate safeguards for the rights and freedoms of the data subject. For the purpose of sub-Article (2) and (3) of this Article, processing shall be permitted if it is done with appropriate safeguards. (3) (4) 18. (1) Further Categories of Sensitive Personal Data The Commission may by a directive prescribe further categories of personal data which may be classified as sensitive personal data. 10