S18 (2) Subsection (1)(a) shall not apply where the information concerns a data subject belonging to the organization mentioned in paragraph (a). Exemption on race of data subject 24. (1) The prohibition on processing personal information concerning the race of a data subject shall not apply if the processing is carried out to – (a) identify a data subject and only when this is essential for that purpose; and (b) comply with the law. (2) In the cases referred to under subsection (1), personal information shall not be supplied to third parties without the consent of the data subject. Exemption on trade union membership of data subject 25. (1) The prohibition on processing personal information on the trade union membership of a data subject, shall not apply to the processing by the trade union to which the data subject belongs or the trade union federation to which that trade union belongs, where the processing is necessary to achieve the aims of the trade union or trade union federation. (2) In the cases referred to under subsection (1), personal information shall not be supplied to third parties without the consent of the data subject. Exemption on political affiliation of data subject 26. (1) The prohibition on processing personal information concerning a political affiliation of a data subject, shall not apply to processing by an institution founded on political principles of the personal information of their members or employees, or other personal belonging to the institution if such processing is necessary to achieve the aims or principles of the institution. (2) In the cases under subsection (1), personal information shall not be supplied to third parties without the consent of the data subject. Exemption on health or sexual life of data subject 27. (1) The prohibition on processing personal information on health or sexual life of a data subject, shall not apply to the processing by – (a) medical professionals, healthcare institutions or facilities or social services, if such processing is necessary for the proper treatment and care of the data subject, or for the administration of the institution or professional practice concerned; (b) insurance companies, medical aid scheme administrators, and managed healthcare organisations where such processing is necessary for – (i) assessing the risk to be insured by the insurance company or covered by the medical aid scheme and the data subject has not objected to the processing; (ii) the performance of an insurance or medical aid agreement; or (iii) the enforcement of any contractual rights and obligations;