Section 27 General authorisation concerning special personal information
The prohibition on processing personal information, as referred to in section 26, does not apply if the—
processing is carried out with the consent of a data subject referred to in section 26;
processing is necessary for the establishment, exercise or defence of a right or obligation in law;
processing is necessary to comply with an obligation of international public law;
processing is for historical, statistical or research purposes to the extent that—
the purpose serves a public interest and the processing is necessary for the purpose concerned; or
it appears to be impossible or would involve a disproportionate effort to ask for consent,
and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the data subject to a disproportionate extent;
information has deliberately been made public by the data subject; or
provisions of sections 28 to 33 are, as the case may be, complied with.
The Regulator may, subject to subsection (3), upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process special personal information if such processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the data subject.
The Regulator may impose reasonable conditions in respect of any authorisation granted under subsection (2).