prejudice a legitimate interest of the data subject; (e) the collection of the data from another source is necessary: (i) for the prevention, detection, investigation, prosecution or punishment of an offence or breach of law; (ii) for the enforcement of a law which imposes a pecuniary penalty; (iii) for the enforcement of a law which concerns revenue collection; (iv) for the conduct of proceedings before any court or tribunal that have commenced or are reasonably contemplated; (v) for the protection of national security; or (vi) for the protection of the interests of a responsible or third party to whom the information is supplied; (f) compliance would prejudice a lawful purpose for the collection; or (g) compliance is not reasonably practicable. Collection of data for specific purpose 22. A data controller who collects personal data shall collect the data for a purpose which is specific, explicitly defined and lawful and is related to the functions or activity of the person. Data subject to be made aware of purpose of collection 23. A data controller who collects data shall take the necessary steps to ensure that the data subject is aware of the purpose for the collection of the data. Retention of records 24. (1) Subject to subsections (2) and (3), a data controller who records personal data shall not retain the personal data for a period longer than is necessary to achieve the purpose for which the data was collected and processed unless (a) the retention of the record is required or authorised by law, (b) the retention of the record is reasonably necessary for a lawful purpose related to a function or activity, (c) retention of the record is required by virtue of a contract between the parties to the contract, or (d) the data subject consents to the retention of the record. (2) Subsection (1) does not apply to records of personal data retained for (a) historical, (b) statistical, or (c) research purposes.