following cases: 9.2.1. Provided in Articles 6 and 7 of this Law. 9.2.2. Healthcare staff to exercise their rights and fulfill obligations specified in the law for the protection of the health of the respective person or others and provision of healthcare services. 9.2.3. Provide an explanation, statement, and evidence in accordance with the law for the requirements of the claims from citizens and legal entities. 9.3. The National Human Rights Commission of Mongolia ("National Human Rights Commission") may make recommendations to data controllers in order to prevent violations of human rights and freedoms in the collection, processing and use of sensitive personal data. Article 10. Collection, Processing and Use of Genetic and Biometric Data 10.1. The following state authorities shall collect and use human genetic and biometric data, in accordance with the grounds and procedures provided by law, for following purposes: 10.1.1. Non-overlapping physiological data (fingerprints) by the state registration authority for the purpose of maintaining civil state registration and monitoring registration of voters. 10.1.2. Biometric data by border protection authority for the purpose of identifying and verifying a foreign citizen crossing the state border. 10.1.3. Genetic and biometric data by the competent authority specified in the law for the purpose of combating, preventing, and investigating crimes and offences. 10.1.4. Genetic and biometric data by a forensic organization for forensic analysis conducted during the course of resolving a case or dispute. 10.1.5. Biometric data of a member of the State Great Khural for the purpose of registering for the meeting and voting. 10.2. An employer may use biometric data other than non-overlapping physiological data (fingerprints) with the employees' consent in order to facilitate the identification and verification of employees under the internal labor procedures. 10.3. An employer is prohibited to process, change or transfer data used as per Paragraph 10.2 of this Law to other persons. 10.4. The data controller shall ensure the security of the collection and use of genetic and biometric data. 10.5. The data controller's compliance with the information security requirements established under the procedure set forth in Sub-paragraph 25.1.2 of this Law shall not serve as a ground for exemption from liability for information loss. Article 11. Data Collection, Processing and Use for Historical, Scientific, Artistic and Literary and Statistical Purposes 11.1. Unless otherwise provided by law, data shall be collected with the consent of the data subject for the purpose of creating historical, scientific, artistic, and literary works and preparing statistical information. 11.2. The data may be processed and used for the purpose of creating historical, scientific, artistic, and literary works and preparing statistical information, regardless of the purpose of the data collected. 11.3. Unless otherwise provided by law or with the written consent of the data subject, the data may be processed and used through de-identification for the purpose of creating historical, scientific,