25. Processing of sensitive personal data (1) No sensitive personal data shall be processed unless the data subject has – (a) given his express consent to the processing of the personal data; or (b) (2) made the data public. Subsection (1) shall not apply where the processing – (a) is necessary – (i) for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with his employment; (ii) in order to protect the vital interests of the data subject or another person in a case where consent cannot be given by or on behalf of the data subject, or the data controller cannot reasonably be expected to obtain the consent of the data subject; (iii) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld; (iv) for the performance of a contract to which the data subject is a party; (v) in order to take steps required by the data subject prior to entering into a contract; (vi) for compliance with a legal obligation to which the data controller is subject; (b) is carried out by any entity or any association which exists for political, philosophical, religious or trade union purposes in the course of its legitimate activities and the processing -