S19 (c) schools, where such processing is necessary to provide special support for pupils or making special arrangements in connection with their health or sexual life; (d) institutions or probation, child protection or guardianship, where such processing is necessary for the performance of their legal duties; (e) correctional institution or facility where such processing is necessary in connection with the implementation of prison sentences or detention measures; or (f) administrative bodies, pension funds, employers or institutions working for them, where such processing is necessary for – (i) the implementation of the provisions of the law, pension regulations or collective agreements which create rights dependent on health or sexual life of the data subject; or (ii) the reintegration of or support for workers or persons entitled to benefit in connection with sickness or work incapacity. (2) In cases under subsection (1), the information shall be processed by a data controller subject to an obligation of confidentiality by virtue of office, employment, profession or legal provision, or established by a written agreement between the data controller and the data subject. (3) A data controller that is permitted to process information on a data subject’s health or sexual life in terms of this section and is not subject to an obligation of confidentiality by virtue of office, profession or legal provision, shall treat the information as confidential, unless the responsible party is required by law or in connection with their duties to communicate the information to other parties who are authorised to process such information. (4) The prohibition on processing any of the categories of personal information shall not apply where it is necessary to supplement the processing of personal information on a data subject’s health, with a view to the proper treatment or care of the data subject. (5) Personal information concerning inherited characteristics shall not be processed in respect of a data subject from whom the information concerned has been obtained unless – (a) a serious medical interest prevails; or (b) the processing is necessary for the purpose of scientific research or statistics. (6) The Commission may prescribe more detailed rules concerning the application of subsection 1(b) and (f). Exemption on criminal behaviour of data subject 28. (1) The prohibition on processing of personal information on criminal behaviour of a data subject, shall not apply where the processing is carried out by a body charged by law with applying criminal law or by a data controller who has obtained that information in accordance with this Act. (2) The prohibition shall not apply to a data controller who processes the information for their own lawful purposes to –