Cyber Security and Data Protection and international forums mandated to deal with the protection of personal information initiatives. (2) Subject to this Act, the Authority shall not, in the lawful exercise of its functions under this Act, be subject to the direction or control of any person or authority. PART IV 5 Quality of Data 9 Quality of Data (1) The data controller shall ensure that data processed is— (a) adequate, relevant and not excessive in relation to the purposes for which it is collected or further processed; (b) accurate and, where necessary, kept up-to-date; (c) retained in a form that allows for the identification of data subjects, for no longer than necessary with a view to the purposes for which the data is collected or further processed. (2) The data controller shall take all appropriate measures to ensure that data processed shall be accessible regardless of the technology used and ensure that the evolution of technology shall not be an obstacle to the access or processing of such data. (3) The controller shall ensure compliance with the obligations set out in subsections (1) and (2) by any person working under his or her authority and any subcontractor. 10 15 20 PART V General Rules on the Processing of Data 10 Generality The data controller shall ensure that the processing of data is necessary and that the data is processed fairly and lawfully. 11 25 Purpose (1) The data controller shall ensure that data is collected for specified, explicit and legitimate purposes and, taking into account all relevant factors, especially the reasonable expectations of the data subject and the applicable legal and regulatory provisions, that the data is not further processed in a way incompatible with such purposes. 30 (2) Under the conditions established by the Authority, further processing of data for historical, statistical or scientific research purposes is not considered incompatible. 12 Non-sensitive data 35 (1) Personal information may only be processed if the data subject or a competent person, where the data subject is a child, consents to the processing of such data. (2) The consent referred to in subsection (1) may be implied where the data subject is an adult natural person or has a legal persona and has full legal capacity to consent. 8 40