General exemption on sensitive personal information 36 (1) Without prejudice to sections 29 to 35, the prohibition on processing personal information shall not apply where – (a) processing is carried out with prior parental consent where the data subject is a child and is subject to parental control in terms of the law; (b) the processing is necessary for the establishment, exercise or defence of a right or obligation in law; (c) processing is necessary to comply with an obligation of international public law; (d) the Commission has granted authority in terms of section 37 for processing in the public interest, and appropriate guarantees have been put in place in law to protect the data subject’s privacy; (e) processing is carried out with the consent of the data subject; or (f) the information has deliberately been made public by the data subject. Authorisation by the Commission 37 (1) The Commission may authorise a data controller to process personal information, where the Commission is satisfied that, in the circumstances of the case (a) the public interest in the processing outweighs, to a substantial degree, any interference with the privacy of the data subject that could result from such processing; or