Cyber Security and Data Protection 5 10 15 (3) The processing of non-sensitive data is permitted, without the consent of the data subject, where necessary for purposes of— (a) being material as evidence in proving an offence; or (b) compliance with an obligation to which the controller is subject by or by virtue of a law; or (c) protecting the vital interests of the data subject; or (d) performing a task carried out in the public interest, or in the exercise of the official authority vested in the controller, or in a third party to whom the data is disclosed; or (e) promoting the legitimate interests of the controller or a third party to whom the data is disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject claiming protection under this Act. (4) The Authority may specify the circumstances in which the condition stipulated under subsection (3)(e) are considered as having been met. 13 20 25 30 35 40 45 Sensitive information (1) In relation to the processing of sensitive personal information— (a) the processing of sensitive data is prohibited unless the data subject has given consent in writing for such processing; (b) the consent may be withdrawn by the data subject at any time and without any explanation and free of charge; (c) the Authority shall determine the circumstances in which the prohibition to process the data referred to in this section cannot be lifted even with the data subject’s consent “taking into account the factors surrounding the prohibition and the reasons for collecting the data”. (2) The provisions of subsection (1) shall not apply where— (a) the processing is necessary to carry out the obligations and specific rights of the controller in the field of employment law; or (b) the processing is necessary to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving his or her consent or is not represented by his or her legal, judicial or agreed representative; or (c) the processing is carried out in the course of its legitimate activities by a foundation, association or any other non-profit organisation with a political, philosophical, religious, health-insurance or trade-union purpose and on condition that the processing relates solely to the members of the organisation or to persons who have regular contact with it in connection with such purposes and that the data is not disclosed to a third party without the data subjects’ consent; or (d) the processing is necessary to comply with national security laws; or (e) the processing is necessary, with appropriate guarantees, for the establishment, exercise or defence of legal claims; or (f) the processing relates to data which has been made public by the data subject; or (g) the processing is necessary for the purposes of scientific research: Provided the Authority shall be entitled to specify the conditions under which such processing may be carried out; or 9