(4) into a contract; (c) The processing is necessary for compliance with a legal obligation to which the data controller is subject; (d) The processing is necessary to protect vitally important interests of the data subject, including life and health; (e) The processing is necessary in order to respond to a public health crisis or national emergency or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate within the limits of a law issued for this purpose; or (f) The processing is necessary for the purposes of the legitimate interests pursued by the personal data controller to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection of personal data. For the purpose of sub-Article (3) lit. (e) of this Article, (a) The law shall pursue public interest objectives; (b) The interference with privacy through data processing shall be necessary and proportionate; (c) The law shall determine the essential elements of processing such as the categories of data, the purpose, storage period, and possible disclosure; and (d) Further processing of personal data after the expiry of such law shall be prohibited. (5) 16. (1) (2) (3) (4) (5) Data processing shall be proportionate in relation to the legitimate purpose pursued. Conditions for Consent For the purpose of Article 15 sub-Article (3) lit. (a) of this Proclamation, personal data may be processed on the basis of the consent of the data subject, shall be given prior to the commencement of the processing. For the consent of the data subject to be valid, it must be free, informed, specific, clear and require an active action from the data subject. Where consent has been given verbally, the burden of proof shall rest upon the data controller. The data subject may withdraw his consent at any time. Information with regard to withdrawal of consent shall be given prior to giving his consent. The data controller shall not make the provision of any goods or services or the quality thereof, the performance of any contract, or the enjoyment of any legal right or claim, conditional on consent to processing of any personal data not necessary for that purpose. The application of this provision shall be decided on a case by case basis. The data controller shall bear the burden of proof to establish that consent has been given by the data subject for processing of personal data in accordance with sub-Article (2) of this Article. The request for consent shall be presented in a manner which is clearly distinguishable and separate from other matters; request for consent cannot be bundled with other terms and conditions. 9