Data Protection [No. 3 of 2021 101 (iii) in order to protect the vital interests of the data subject or of another natural person; (iv) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; (v) for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child; or (c) the processing relates to personal data which is manifestly made public by the data subject. 14. (1) A person shall not process sensitive personal data, unless— Processing of sensitive personal data (a) processing is necessary for the establishment, exercise or defence of a legal claim or whenever a court is exercising a judicial function; (b) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services ;or (c) processing is necessary for reasons of public interest. (2) Personal data under subsection (1)(b) may be processed when the data is processed by or under the responsibility of a professional, subject to secrecy and other obligations imposed by any law or professional bodies regulating them. (3) Personal data referred to under subsection (1) (c) shall be processed only where adequate measures to safeguard the rights and freedoms of the data subject have been put in place. 15. (1) A data controller shall not process personal data unless the data subject consents to the processing. (2) A data subject may consent to the processing of that data subject’s personal data in writing. Consent, justification and objection