(a) a serious medical interest prevails; or (b) the processing is necessary for the purpose of scientific research or statistics. (6) The Commission may prescribe more detailed rules concerning the application of subsection 1(b) and (f). Exemption on data subject’s criminal behaviour 35 (7) The prohibition on processing of personal information on a data subject’s criminal behaviour, shall not apply where the processing is carried out by a body charged by law with applying criminal law or by a data controller who has obtained that information in accordance with the law. (8) The prohibition shall not apply to a data controller who processes the information for their own lawful purposes to – (a) assess an application by a data subject in order to take a decision about, or provide a service to that data subject; or (b) protect their legitimate interests in relation to criminal offences which have been or can reasonably be expected to be committed against them or against persons in their service. (9) The processing of information concerning personnel in the service of the data controller shall take place in accordance with the rules established in compliance with the labour laws. (10) The prohibition on processing any of the categories of personnel information referred to in section 29(b) shall not apply where such processing is necessary to supplement the processing of information on criminal behaviour permitted under this section.