(3) A person who retains records for historical, statistical or research purposes shall ensure that the records that contain the personal data are adequately protected against access or use for unauthorised purposes. (4) A person who uses a record of the personal data of a data subject to make a decision about the data subject shall (a) retain the record for a period required or prescribed by law or a code of conduct, or (b) where there is no law or code of conduct that provides for the retention period, retain the record for a period which will afford the data subject an opportunity to request access to the record. (5) A data controller shall destroy or delete a record of personal data or de-identify the record at the expiry of the retention period. (6) The destruction or deletion of a record of personal data shall be done in a manner that prevents its reconstruction in an intelligible form. Further processing to be compatible with purpose of collection 25. (1) Where a data controller holds personal data collected in con- nection with a specific purpose, further processing of the personal data shall be for that specific purpose. (2) A person who processes data shall take into account (a) the relationship between the purpose of the intended further processing and the purpose for which the data was collected, (b) the nature of the data concerned, (c) the manner in which the data has been collected, (d) the consequences that the further processing is likely to have for the data subject, and (e) the contractual rights and obligations between the data subject and the person who processes the data. (3) The further processing of data is considered to be compatible with the purpose of collection where (a) the data subject consents to the further processing of the information, (b) the data is publicly available or has been made public by the person concerned, (c) further processing is necessary (i) for the prevention, detection, investigation, prosecution or punishment for an offence or breach of law, (ii) for the enforcement of a law which imposes a pecuniary penalty, (iii) for the enforcement of legislation that concerns pro- tection of revenue collection, (iv) for the conduct of proceedings before any court or tribunal