prevents offences, assists prosecution or serves national defence interests, or c. is provided for by law for purposes in the public interest in the case of data listed in Section 3 Subsection 3. (3) In the case of mandatory data control, the law or local government decree providing for the data control determines the type of data to be controlled, the objective and conditions of data control, access to data, the duration of data control, as well as the person of the controller. (4) Only state or local government bodies are entitled to control criminal personal data linked to the prevention and prosecution of offences and controlled to perform public administration and judicial administration tasks, as well as databases registering data in connection with infringements of the rule of law, civil litigation and non-litigation matters. Section 6 (1) Personal data may also be controlled if it is not possible to obtain the consent of the data subject or even if the cost of doing so is excessively high and the personal data a. must be controlled to fulfill legal obligations applicable to the controller, or b. must be controlled to enforce the rightful interests of the controller or third parties and the enforcement of such interests is proportionate to the restrictions pertaining to the right to the protection of personal data. (2) Should the data subject be unable to provide his consent because of his incapacity to act or other circumstances beyond his control, the personal data of the data subject may be controlled during the period in which consent is unavailable, to protect his own or others’ vital interests, as well as to the extent required to avert and prevent direct risks posing a threat to the lives, corporal integrity or property of persons. (3) The consent or subsequent approval of a legal guardian is not required in the case of legal declarations containing the consent of minors aged over 16. (4) Should the aim of the control based on consent relate to executing the contract concluded in writing with the controller, such contract must include all the information the data subject must be aware of – on the grounds of the present legislation – relating to the control of personal data, and therefore, in particular, the determination of the data to be controlled, the duration of control, the purpose of use, evidence of the transfer of data, its recipients and the evidence of the use of a data processor. The contract must clearly and explicitly include that by signing it, the data subject consents to the control of its data in accordance with the conditions set out in the contract. (5) If personal data was recorded with the consent of the data subject, the controller may, should it not otherwise be regulated by law, also control the data recorded a. to fulfil their relevant legal obligations, or b. to enforce the rightful interest of the controller or third party should the enforcement of these interests be proportionate to restrictions pertaining to the protection of personal data without having to secure any additional special consent, even after the data subject withdraws their consent. (6) A legal opinion must be issued in respect of the personal data provided in the consent by the data subject and required to conduct the legal or administrative proceedings launched pursuant to the request or initiative of the data subject, or in respect of the personal data they provided in the event of other matters being launched pursuant to the request of the data subject. (7) The consent of the data subject shall be considered as a fact in regard to personal data announced or disclosed by the data subject during public appearances. (8) Should doubts arise, a legal opinion must be issued setting forth how the data subject failed to provide their consent.