323 The Data Protection Bill, 2018 (2) The provisions of subsection (1) shall not apply where processing of personal information is - information. carried out with the consent of the data subject; required under national or international law; for the purpose of statistical or research purposes; or publicly available. 25. An agency may process information relating to the religious or philosophical beliefs of a data subject where the agency is a spiritual or religious organisation or an independent section of a spiritual or religious organisation and where the data subject is an employee or member of that organisation; and has consented to the processing of that information. 26. An agency may process personal information relating to a data subject's race or ethnic origin if the processing isessential to the identification of the data subject; and in compliance with lawful measures for the protection and advancement of a category of persons disadvantaged by unfair discrimination. 27. An agency may process personal information relating to a data subject's trade union membership wherethe agency is a trade union to which the data subject belongs; and the processing is necessary for the aims of the trade union. 28. An agency may process personal information relating to a data subject's health where the agency isa medical institution or social service institution processing information for purposes of treatment and care of the data subject; an insurance company or a medical scheme processing information for purposes of entering into or performing an insurance contract; Processing of information concerning religious or philosophical beliefs. Data subject's race or ethnic Data subject's activities. Data subject's ea