a) the risk of significant harm that may be caused to a data subject or class of data subjects by the processing of a category of such sensitive personal data; b) the reasonable expectation of confidentiality attached to such category of sensitive personal data; and c) the adequacy of protection afforded to personal data generally. Article 15: Purpose specification, data minimisation, retention and accuracy A data controller shall ensure that personal data it processes is: a) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; b) adequate, relevant and limited to what is the minimum necessary for such purposes; c) retained for no longer than is necessary to achieve such purposes except where: i. such retention is required or authorised by law; or ii. the data subject has consented to such retention; and d) accurate, complete, not misleading and, where necessary, kept up to date. Article 16: Children and other persons lacking legal capacity 1. Where a data subject is a child or an individual otherwise lacking legal capacity, any consent that is required to be obtained shall be obtained from a parent or other appropriate legal representative. 2. A data controller may rely on consent provided by a child aged sixteen or more for the purposes of article 14(2)(a) in relation to the provision of information and services by electronic means at the individual request of the recipient. 3. The Authority may by regulation determine that sub-article 2 shall also apply to a child aged thirteen or more. 4. A data controller shall apply appropriate processes to verify the identity and age of a data subject and his representative, relationship to the data subject and consent. 5. For the purposes of sub-article 4, presentation of government approved identification documents shall be an appropriate mechanism. 6. Sub-article 1 does not apply when 15