25.
Processing of sensitive personal data
(1)
No sensitive personal data shall be processed unless the data
subject has –
(a)
given his express consent to the
processing of the personal data; or
(b)
(2)
made the data public.
Subsection (1) shall not apply where the processing –
(a)
is necessary –
(i)
for the purposes of exercising or performing any
right or obligation which is conferred or imposed by law on
the data controller in connection with his employment;
(ii)
in order to protect the vital interests of the data
subject or another person in a case where consent cannot
be given by or on behalf of the data subject, or the data
controller cannot reasonably be expected to obtain the
consent of the data subject;
(iii)
in order to protect the vital interests of another
person, in a case where consent by or on behalf of the
data subject has been unreasonably withheld;
(iv)
for the performance of a contract to which the data
subject is a party;
(v)
in order to take steps required by the data subject
prior to entering into a contract;
(vi)
for compliance with a legal obligation to which the
data controller is subject;
(b)
is carried out by any entity or any association which
exists for political, philosophical, religious or trade union purposes
in the course of its legitimate activities and the processing -