(a) a serious medical interest prevails; or
(b) the processing is necessary for the purpose of scientific research or
statistics.
(6) The Commission may prescribe more detailed rules concerning the
application of subsection 1(b) and (f).
Exemption on data subject’s criminal behaviour
35
(7) The prohibition on processing of personal information on a data subject’s
criminal behaviour, shall not apply where the processing is carried out by a
body charged by law with applying criminal law or by a data controller who
has obtained that information in accordance with the law.
(8) The prohibition shall not apply to a data controller who processes the
information for their own lawful purposes to –
(a) assess an application by a data subject in order to take a decision
about, or provide a service to that data subject; or
(b) protect their legitimate interests in relation to criminal offences
which have been or can reasonably be expected to be committed
against them or against persons in their service.
(9) The processing of information concerning personnel in the service of the
data controller shall take place in accordance with the rules established in
compliance with the labour laws.
(10)
The prohibition on processing any of the categories of personnel
information referred to in section 29(b) shall not apply where such
processing is necessary to supplement the processing of information on
criminal behaviour permitted under this section.