a) the processing is necessary to protect the vital interests of the child or individual lacking the legal capacity to consent; b) the processing is carried out for purposes of education or medical or social care and is undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality; or c) the processing is necessary for proceedings before a court relating to the individual. Article 17: Establishing data subject consent 1. A data controller shall bear the burden of proof for establishing a person’s consent where any processing relies on consent under this Law. Article 18: Provision of information to a data subject 1. A data controller shall ensure that a data subject is informed prior to collection of the personal data of: a) the identity of, and means of contacting, the data controller; b) the specific basis of processing under article 14(2) and the purposes of the processing; c) the identity of any other entity or person with which the personal data will be shared; d) data subjects’ rights under Chapter IV and rights to lodge complaints with the Authority in accordance with article 31; and e) a description of any automated decision-making, including profiling, significance, envisaged and the likely consequence of such automated decision-making for the data subject. 1. Where the information provided for in sub-article 1 was not provided to the data subject before collection, the data controller shall ensure that it is provided as soon thereafter as possible. 2. Sub-articles 1 and 1 shall not apply if, but only to the extent that, compliance would be impossible or would involve a disproportionate effort or expense. Article 19: Responsibility for data processors 1. A data controller shall keep a record of all data processors that process personal data with respect to which it is a data controller, including data processors engaged by other data processors. 16