Section 24

The Data Controller shall not collect Personal Data without

the consent of the data subject, unless:

(1)it is for the achievement of the purpose relating to the preparation of the

historical documents or the archives for public interest, or for the purpose
relating to research or statistics, in which the suitable measures to safeguard
the data subject's rights and freedoms are put in place and in accordance
with the notification as prescribed by the Committee;

(2)it is for preventing or suppressing a danger to a Person’s life, body or health;

(3)it is necessary for the performance of a contract to which the data subject is a party,

or in order to take steps at the request of the data subject prior to entering into a contract;

(4)it is necessary for the performance of a task carried out in the public interest

by the Data Controller, or it is necessary for the exercising of official
authority vested in the Data Controller;

(5)it is necessary for legitimate interests of the Data Controller or any other Persons

or juristic persons other than the Data Controller, except where such interests are overridden
by the fundamental rights of the data subject of his or her Personal Data;

(6)it is necessary for compliance with a law to which theData Controller is subjected.