(2) Paragraph (1) above shall not apply where: (a) the processing is necessary to carry out the obligations and specific rights of the controller in the field of employment law; or (b) the processing is necessary to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving his/her consent or is not represented by his/her legal, judicial or agreed representative; or (c) the processing is carried out in the course of its legitimate activities by a foundation, association or any other non-profit organization with a political, philosophical, religious, healthinsurance or trade-union purpose and on condition that the processing relates solely to the members of the organization or to persons who have regular contact with it in connection with such purposes and that the data is not disclosed to a third party without the data subjects' consent; or (d) the processing is necessary to comply with national social security laws; or (e) the processing is necessary, with appropriate guaranties, for the establishment, exercise or defense of legal claims; or (f) the processing relates to data which has been made public by the data subject; or (g) (i) the processing is necessary for the purposes of scientific research; (ii) The Authority shall be entitled to specify the conditions under which such processing may be carried out; or (h) the processing of personal data is authorized by a law or any regulation for any other reason constituting substantial public interest. Draft Data Protection Bill Version 1.0 26