No. 136 Chapter 69 Gor Government Gazette 27 May 2019 keep such Personal Data as confidential under the law, it must be for compliance with the contract between the data subject and the medical practitioner; (b) public interest in public health, such as protecting against crossborder dangerous contagious disease or epidemics which may be contagious or pestilent, or ensuring standards or quality of medicines, medicinal products or medical devices, on the basis that there is a provision of suitable and specific measures to safeguard the rights and freedom of the data subject, in particular maintaining the secrecy of Personal Data in accordance with the duties or professional ethics; (c) employment protection, social security, national health security, social health welfare of the entitled person by law, the road accident victims protection, or social protection in which the collection of Personal Data is necessary for e xercising the rights or carrying out the obligations of the Data Controller or the data subject, and the suitable measures have been provided to protect the fundamental rights and interest of the data subject; (d) it is for the scientific, historical, or statistic research purposes, or other public interests which must be carried out only to the extent necessary to achieve such purposes, and the suitable measures have been provided to protect the fundamental rights and interest of the data subject as prescribed by the Committee; or (e) the substantial public interest, and the suitable measures have been provided to protect the fundamental rights and interest of the data subject. The biometric data in paragraph one shall mean the Personal Data arising from the use of technics or technology related to the physical or behavioral dominance of Person, which can be used to identify such Person apart from other Persons, such as the facial recognition data, iris recognition data or fingerprint recognition data. In the case of the collection of the Personal Data relating to criminal record, such collection shall be carried out under the control of authorized official authority under the law, or the data protection measure has been implemented according to rules prescribed by the Committee. Part 3 Use or Disclosure of Personal Data --------------------------Section 27 The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it is the Personal Data which is collected without requirement of consent under Section 24 or Section 26. The Person or juristic person who obtains Personal Data as a result of the disclosure under paragraph one shall not use or disclose such Personal Data for any purpose 13