General authorisation concerning special personal information
27. (1) The prohibition on processing personal information, as referred to in the section
26, does not apply if the—
(a) processing is carried out with the consent of a data subject referred to in
(b) processing is necessary for the establishment, exercise or defence of a right or
obligation in law;
(c) processing is necessary to comply with an obligation of international public
(d) processing is for historical, statistical or research purposes to the extent that—
(i) the purpose serves a public interest and the processing is necessary for
the purpose concerned; or
(ii) it appears to be impossible or would involve a disproportionate effort to
ask for consent,
and sufficient guarantees are provided for to ensure that the processing does
not adversely affect the individual privacy of the data subject to a
(e) information has deliberately been made public by the data subject; or
(f) provisions of sections 28 to 33 are, as the case may be, complied with.
(2) The Regulator may, subject to subsection (3), upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process special personal information if such processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the data subject.
(3) The Regulator may impose reasonable conditions in respect of any authorisation
granted under subsection (2).