(2) Personal information shall be processed if – (a) The data subject provides explicit consent to the processing; (b) Processing is necessary for the conclusion or performance of a contract to which the data subject is a party; (c) Processing is necessary for compliance with a legal obligation to which the data controller is subject; (d) Processing is necessary to protect the legitimate interests of the data subject; (e) Processing is necessary for the proper performance of public law duty by a public body; or (f) Processing is necessary for pursuing the legitimate interests of the data controller or of a third party to whom the information is supplied. (3) A data subject, may, on compelling legitimate grounds, raise a written objection to the processing of data relating to him on the grounds listed in subsection (1) with the Commission, and where the objection is upheld by the Commission, the data controller shall not process the data. Minimality 16 Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive. Collection directly from the data subject