Acts 2017 493 (vi) the exercise, by any person in the public interest, of any other functions of a public nature; (vii) for the legitimate interests pursued by the controller or by a third party to whom the data are disclosed, except if the processing is unwarranted in any particular case having regard to the harm and prejudice to the rights and freedoms or legitimate interests of the data subject; or (viii) for the purpose of historical, statistical or scientific research. (2) Any person who contravenes subsection (1) shall commit an offence and shall, on conviction, be liable to a fine not exceeding 100, 000 rupees and to imprisonment for a term not exceeding 5 years. 29. Special categories of personal data (1) Special categories of personal data shall not be processed unless – (a) section 28 applies to the processing; and (b) the processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects; (c) the processing relates to personal data which are manifestly made public by the data subject; or (d) the processing is necessary for – (i) the establishment, exercise or defence of a legal claim;