(ii) in order to protect the vital interests of the data subject or another person, in a case where— (A) consent cannot be given by or on behalf of the data subject; or (B) the data controller cannot reasonably be expected to obtain the consent of the data subject; (iii) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld; (iv) for medical purposes and is undertaken by— (A) a healthcare professional; or (B) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a healthcare professional; (v) for the purpose of, or in connection with, any legal proceedings; (vi) for the purpose of obtaining legal advice while ensuring its integrity and secrecy; (vii) for the purposes of establishing, exercising or defending legal rights; (viii) for the administration of justice pursuant to orders of a court of competent jurisdiction; or (ix) for the exercise of any functions conferred on any person by or under any written law; or (c) the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject. (2) The Commission may by order published in the Gazette exclude the application of clauses (i), (viii) or (ix) of clause (b) of subsection (1) in such cases as may be specified in the order, or provide that, in such cases as may be specified in the order, any condition in clauses (i), (viii) or (ix) of clause (b) of subsection (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied. Explanation.- For the purposes of this section— “medical purposes” includes the purposes of preventive medicine, medical diagnosis, medical research, rehabilitation and the provision of care and treatment and the management of healthcare services; “healthcare professional” means a medical practitioner, dental practitioner, pharmacist, clinical psychologist, nurse, midwife, medical assistant, physiotherapist, occupational therapist and other allied healthcare professionals and any other person involved in the giving of medical, health, dental, pharmaceutical or any other healthcare services authorised to provide such services under the laws of Pakistan. CHAPTER V EXEMPTIONS 27. Repeated collection of personal data in same circumstances​.- (1) Where a data controller— (a) has complied with the requirements of this Act in respect of the collection of personal data from the data subject, referred to as the “first collection”; and (b) on any subsequent occasion again collects personal data from that data subject, referred to as the “subsequent collection”, 16