controller and a third party in the interest of the data subject; (d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defense of legal claims; (e) the transfer is necessary in order to protect the legitimate interests of the data subject; and (f) the transfer is made from a register which, according to acts or regulations, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the case at hand. (5)Without prejudice to the provisions of the previous paragraph, the Commissioner may authorize a transfer or a set of transfers of personal information to a recipient country outside Lesotho or SADC which does not in its laws ensure an adequate level of protection, if the controller satisfies the Commissioner that it shall ensure adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of the data subjects concerned, and regarding the exercise of the data subject’s rights such safeguards can be appropriated through adequate legal and security measures and contractual clauses in particular.