17 (1) A person shall collect personal information directly from the data subject, except where – (a) The information is contained in a public record or has deliberately been made public by the data subject; (b) The data subject has consented to the collection of the information from another source; (c) Collection of the information from another source would not prejudice a legitimate interest of the data subject; (d) Collection of the information from another source is necessary – (i) To avoid prejudice to the maintenance or enforcement of the law and order; (ii) For the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; (iii) In the legitimate interests of national security; (iv) To maintain the legitimate interests of the data controller or of a third party to whom the information is supplied (e) Compliance would prejudice a lawful purpose of the collection; or (f) Compliance is not reasonably practicable in the circumstances of the particular case. Purpose specification and further processing limitation 18 (1) Personal data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a way incompatible with