Regulator may exempt processing of personal information
37. (1) The Regulator may, by notice in the Gazette, grant an exemption to a responsible party to process personal information, even if that processing is in breach of a condition for the processing of such information, or any measure that gives effect to such condition if the Regulator is satisfied that, in the circumstances of the case—
(a) the public interest in the processing outweighs, to a substantial degree, any interference with the privacy of the data subject that could result from such processing; or
(b) the processing involves a clear benefit to the data subject or a third party that
outweighs, to a substantial degree, any interference with the privacy of the
data subject or third party that could result from such processing.
(2) The public interest referred to in subsection (1) includes—
(a) the interests of national security;
(b) the prevention, detection and prosecution of offences;
(c) important economic and financial interests of a public body;
(d) fostering compliance with legal provisions established in the interests referred to under paragraphs (b) and (c);
(e) historical, statistical or research activity; or
(f) the special importance of the interest in freedom of expression.
(3) The Regulator may impose reasonable conditions in respect of any exemption
granted under subsection (1).