Personal data shall only be processed in one of the following cases: a) if the data subject has unambiguously given his consent; b) if processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; c) if processing is necessary for compliance with an obligation to which the controller is subject by or by virtue of a law, decree or ordinance; d) if processing is necessary in order to protect the vital interests of the data subject; e) if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; f) if processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party to whom the data are disclosed, provided that the interests or fundamental rights and freedoms of the data subject who has a claim to protection under this law, do not prevail. The King may specify in a decree agreed upon in the Council of Ministers after advice of the Commission for the protection of privacy in which circumstances the condition laid down sub f) shall be considered not being complied with. Article 6 § 1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership as well as the processing of data concerning sex life, shall be prohibited. § 2. The prohibition of processing data referred to in § 1 shall not apply in one of the following cases: a. if the data subject has given his written consent to the processing of those data, on the understanding that the consent may be withdrawn by the data subject at any time; the King may lay down in a decree agreed upon in the Council of Ministers after advice of the Commission for the protection of privacy, in which cases the prohibition of processing data referred to in this Article may not be lifted by the explicit consent of the data subject; b. if processing is necessary for the purposes of carrying out the specific obligations and rights of the controller in the field of employment law; c. if processing is necessary to protect the vital interests of the data subject or another person, provided that the data subject is physically or legally incapable of giving his consent; d. if processing is carried out in the course of its legitimate activities by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious, mutual-benefit or trade-union aim provided that the processing relates solely to the members of the foundation, association or body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the persons concerned; e. if processing relates to data that are apparently made public by the data subject; f. if processing is necessary for the establishment, exercise or defence of legal claims; g. if processing is necessary for scientific research and carried out under the terms established by the King in a decree agreed upon in the Council of Ministers after advice of the Commission for the protection of privacy; h. if the processing is necessary for the realisation of an objective laid down by or by virtue of the law in view of the application of social security; 5