a) disclose the interest to the Board and recuse himself or herself from any activity relating to the relevant data controller or data processor, and shall receive no information about such matter; or b) irrevocably and immediately divest the interest to the satisfaction of the Board; or c) resign from his or her position with the Authority. CHAPTER III— PRINCIPLES GOVERNING PROCESSING OF PERSONAL DATA Article 13: Establishment of the Data Protection Authority 1. The Authority is an independent agency in accordance with article 6 and shall become an authority vested with all of the functions, powers and duties provided for in this Law. 2. The Authority shall have a General Manager proposed by the Minister, confirmed by the Cabinet, and appointed by the President of the Federal Republic of Somalia: a) the General Manager shall have experience and expertise in matters of data protection, government administration, business or law; b) the General Manager shall be responsible for carrying out the functions, exercising the powers and performing the duties of the Authority under this Law; c) the activities of the Authority shall be funded from allocations from the National Budget and revenues from administrative penalties, fees, levies and fines made under this Law. 3. the Minister shall ensure that the General Manager has the staff and resources required to carry out the functions of the Authority under this Law. Article 14: Lawfulness of processing of personal data 1. A data controller shall ensure that personal data is processed fairly, in a transparent manner and in accordance with sub-article 2. 2. A data controller shall not process personal data, or permit personal data for which it is responsible to be processed, unless: a) the data subject has given and not withdrawn consent for the specific purpose or purposes for which it will be processed; b) the processing is necessary for the entering into or performance of a contract with the data subject; 13