(2) Personal information shall be processed if –
(a) The data subject provides explicit consent to the processing;
(b) Processing is necessary for the conclusion or performance of a
contract to which the data subject is a party;
(c) Processing is necessary for compliance with a legal obligation to
which the data controller is subject;
(d) Processing is necessary to protect the legitimate interests of the data
subject;
(e) Processing is necessary for the proper performance of public law
duty by a public body; or
(f) Processing is necessary for pursuing the legitimate interests of the
data controller or of a third party to whom the information is
supplied.
(3) A data subject, may, on compelling legitimate grounds, raise a written
objection to the processing of data relating to him on the grounds listed in
subsection (1) with the Commission, and where the objection is upheld by
the Commission, the data controller shall not process the data.
Minimality
16
Personal information may only be processed if, given the purpose for which it is
processed, it is adequate, relevant and not excessive.
Collection directly from the data subject