Cyber Security and Data Protection (h) the processing of data is authorised by a law or any regulation for any other reason constituting substantial public interest. (3) Without prejudice to the application of sections 5 to 8, the processing of data relating to sex life is authorised if— (a) it is carried out by an association with a legal personality or by an organisation of public interest whose main objective, according to its Memorandum and Articles of Association, is the evaluation, guidance or treatment of persons of such sexual conduct, and who is recognised by a competent public body as being responsible for the welfare of such persons; (b) the objective of the processing of the data consist of the evaluation, guidance and treatment of the persons referred to in this section, and the processing of data relates only to the aforementioned persons: Provided that the competent public body referred to in paragraph (a) grants a specific, individualised authorisation, having received the opinion of the Authority. 5 10 15 (4) The authorisation referred to in this section shall specify the duration of the authorisation, the conditions for supervision of the authorised association or organisation by the competent public body, and the way in which the processing must be reported to the Authority. 14 Genetic data, biometric sensitive data and health data 20 (1) The processing of genetic data, biometric data and health data is prohibited unless, the data subject has given consent in writing to the processing. (2) The consent referred to in subsection (1) can be withdrawn by the data subject at any time without any reasons and free of charge. (3) The provisions of subsection (1) shall not apply where— (a) the processing is necessary to carry out the specific obligations and rights of the controller in the field of employment law; or (b) the processing is necessary to comply with national security laws; or (c) the processing is necessary for the promotion and protection of public health, including medical examination of the population; or (d) the processing is required by or by virtue of a law or any equivalent legislative act for reasons of substantial public interest; or (e) the processing is necessary to protect the vital interests of the data subject or another person, where the data subject is physically or legally incapable of giving his or her consent or is not represented by his or her legal, judicial or agreed representative; or (f) the processing is necessary for the prevention of imminent danger or the mitigation of a specific criminal offence; or (g) the processing relates to data which has apparently been made public by the data subject; or (h) the processing is necessary for the establishment, exercise or defense of legal rights; or (i) the processing is required for the purposes of scientific research; or (j) the processing is necessary for the purposes of preventive medicine or medical diagnosis, the provision of care or treatment for the data subject or to one of his or her relatives, or the management of health-care services 10 25 30 35 40 45