(Unofficial Translation) No. 136 Chapter 69 Gor Government Gazette 27 May 2019 (2) it can be done by the provisions of this Act or in other laws. Part 2 Personal Data Collection --------------------------Section 22 The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of the Data Controller. Section 23 In collecting the Personal Data, the Data Controller shall inform the data subject, prior to or at the time of such collection, of the following details, except the case where the data subject already knows of such details: (1) the purpose of the collection for use or disclosure of the Personal Data, including the purpose which is permitted under section 24 for the collection of Personal Data without the data subject's consent; (2) notification of the case where the data subject must provide his or her Personal Data for compliance with a law, or contract, or where it is necessary to provide the Personal Data for the purpose of entering into the contract, including notification of the possible effect where the data subject does not provide such Personal Data; (3) the Personal Data to be collected and the period for which the Personal Data will be retained. If it is not possible to specify the retention period, the expected data retention period according the data retention standard shall be specified; (4) the categories of Persons or entities to whom the collected Personal Data may be disclosed; (5) information, address, and the contact channel details of the Data Controller, where applicable, of the Data Controller's representative or data protection officer; (6) the rights of the data subject under section 19 paragraph five, section 30 paragraph one, section 31 paragraph one, section 32 paragraph one, section 33 paragraph one, section 34 paragraph one, section 36 paragraph one, and section 73 paragraph one. Section 24 The Data Controller shall not collect Personal Data without the consent of the data subject, unless: (1) it is for the achievement of the purpose relating to the preparation of the historical documents or the archives for public interest, or for the purpose relating to research or statistics, in which the suitable measures to safeguard the data subject's rights and freedoms are put in place and in accordance with the notification as prescribed by the Committee; (2) it is for preventing or suppressing a danger to a Person’s life, body or health; (3) it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract; (4) it is necessary for the performance of a task carried out in the public interest by the Data Controller, or it is necessary for the exercising of official authority vested in the Data Controller; (5) it is necessary for legitimate interests of the Data Controller or any other Persons or juristic persons other than the Data Controller, except where such interests are 9