Cyber and Data Protection Act, 2021 (4) 11. Zimbabwe (d) performing a task carried out in the public interest, or in the exercise of the official authority vested in the controller, or in a third party to whom the data is disclosed; or (e) promoting the legitimate interests of the controller or a third party to whom the data is disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject claiming protection under this Act. The Authority may specify the circumstances in which the condition stipulated under subsection (3) (e) are considered as having been met. Sensitive information (1) No data controller shall process sensitive data unless the data subject has given consent in writing for such processing; (2) The consent to the processing of data may be withdrawn by the data subject at any time and without any explanation and free of charge; (3) The Authority shall determine the circumstances in which the prohibition to process the data referred to in this subsection (1) cannot be lifted even with the data subject’s consent (taking into account the factors surrounding the prohibition and the reasons for collecting the data). (4) The Minister responsible for the Cyber security and Monitoring Centre in consultation with the Minister, may give directions on how to implement this section with respect to sensitive information affecting national security or the interests of the State. (5) The provisions of subsection (1) shall not apply where— (a) the processing is necessary to carry out the obligations and specific rights of the controller in the field of employment law; or (b) the processing is necessary to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving his or her consent or is not represented by his or her legal, judicial or agreed representative; or (c) the processing is carried out in the course of its legitimate activities by a foundation, association or any other non-profit organisation with a political, philosophical, religious, health-insurance or trade-union purpose and on condition that the processing relates solely to the members of the organisation or to persons who have regular contact with it in connection with such purposes and that the data is not disclosed to a third party without the data subjects’ consent; or (d) the processing is necessary to comply with national security laws; or (e) the processing is necessary, with appropriate guarantees, for the establishment, exercise or defence of legal claims; or (f) the processing relates to data which has been made public by the data subject; or (g) the processing is necessary for the purposes of scientific research: Provided the Authority shall be entitled to specify the conditions under which such processing may be carried out; or (h) (6) the processing of data is authorised by a law or any regulation for any other reason constituting substantial public interest. Without prejudice to the application of sections 5 to 8, the processing of data relating to sex life is authorised if— (a) it is carried out by an association with a legal personality or by an organisation of public interest whose main objective, according to its Memorandum and Articles of Association, By Laws.Africa and contributors. Licensed under CC-BY. Share widely and freely. 6