8 advisory committees Data Protection No. 3 7.__(1) the authority may establish such number of advisory committees, as the authority determines necessary, to advise the authority in the discharge of its functions under this act. (2) an advisory committee established under subsection (1) shall comprise— (a) a representative of data subjects; (b) a representative of data controllers; (c) a representative of data processors; (d) an expert in data protection; and (e) such other experts from any other relevant field as the authority may determine. (3) the authority shall designate one of its members, other than an ex-officio member, as chairperson of a committee established under subsection (1). (4) an advisory committee shall act in accordance with the mandate and any directions given to it, in writing, by the authority. cap. 68:01 (5) the terms and conditions applicable to members of a committee of the authority established under the communications act shall apply to members of an advisory committee established under subsection (1). (6) the Director General of the authority shall act as secretary to an advisory committee established under subsection (1) or may, with the approval of the chairperson of the authority, delegate a senior member of staff to act as secretary to the advisory committee. Personal data to be processed lawfully, fairly, etc. Part III—PrIncIPLes reLatInG tO the PrOcessInG OF PersOnaL Data __ 8. (1) a data controller and data processor shall process personal data lawfully, fairly and in a transparent manner. (2) the processing of personal data shall be lawful if— (a) the data subject provides consent to a data controller or data processor to process the data for one or more specific purposes or, where the data subject has no capacity to provide consent, another natural person who has authority to provide consent on behalf of the data subject provides the consent; or (b) the processing of the data is— (i) necessary for the performance of a contract to which the data subject is a party or, at the request of the data subject prior to the data subject entering into the contract;