19 Sensitive information Draft Data Protection Bill Version 1.0 (1) In relation to the processing of sensitive personal information, (a) The processing of sensitive data is prohibited unless the data subject has given consent in writing for such processing (b) This consent can be withdrawn by the data subject at any time and without any explanation and free of charge. (c) The Authority may determine the cases in which the prohibition to process the data referred to in this section article cannot be lifted even with the data subject's consent “taking into account the factors surrounding the prohibition and the reasons for collecting the data.” 25