A’ 137/29.08.2019 GOVERNMENT GAZETTE Code of Lawyers. The Authority may also be represented on a case-by-case basis by lawyers specialised in their subject matter by means of a reasoned decision providing the relevant power of attorney. CHAPTER C SUPPLEMENTARY MEASURES FOR THE IMPLEMENTATION OF THE GDPR REGARDING THE PROCESSING OF PERSONAL DATA Article 21 Consent of minors 1. Where point (a) of Article 6(1) applies, in relation to the offering of information society services directly to a minor, the processing of the personal data of a minor shall be lawful where the minor is at least 15 years old and gives his or her consent. 2. Where the minor is below the age of 15 years, the processing referred to in paragraph 1 shall be lawful only if consent is given by the legal representative of the minor. Article 22 Processing of special categories of personal data 1. By way of derogation from Article 9(1) of the GDPR, the processing of special categories of personal data within the meaning of Article 9(1) of the GDPR by public and private bodies shall be allowed, if necessary: (a) for the purpose of exercising the rights arising from the right to social security and social protection, and for fulfilling the obligations arising therefrom; (b) for the purposes of preventive medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or the management of health or social care systems or pursuant to a contract with a health professional or other person who is subject to a duty of professional secrecy or supervised by him/her; or (c) for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, in addition to the measures referred to in the second subparagraph of paragraph 3, the provisions ensuring professional secrecy provided for in a law or code of conduct must in particular be complied with. 2. By way of derogation from Article 9(1) of the GDPR, the processing of special categories of personal data by public bodies within the meaning of Article 9(1) of the GDPR shall be allowed, where it is: (a) strictly necessary for reasons of essential public interest; (b) necessary for the prevention of major threats to national or public security; or (c) necessary for taking humanitarian action, in which case the interests in the processing override the interests of the data subject. 3. In the cases referred to in the previous paragraphs, all appropriate and specific measures shall be taken to safeguard the interests of the data subject. Taking into account the state of the art, the cost of implementation and 3385 the nature, scope, context and purposes of processing as well as the risks of varying severity for rights and freedoms of natural persons posed by the processing, such measures may include in particular: (a) technical and organisational measures to ensure that the processing complies with the GDPR; (b) measures to ensure that ex post verification and determination of whether and by whom personal data have been entered, amended or removed is possible; (c) measures to raise awareness among staff involved in the processing; (d) access rights restrictions to controllers and processors; (e) pseudonymisation of personal data; (f) encryption of personal data; (g) measures to ensure the ability, confidentiality, integrity, availability and resilience of processing systems and services relating to the processing of personal data, including the ability to rapidly restore the availability and access in the event of a physical or technical incident; (h) procedures for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing; (i) specific rules to ensure compliance with this Law and the GDPR in case of transfer or processing for other purposes; (j) designation of a DPO. Article 23 Processing of genetic data The processing of genetic data for health and life insurance purposes shall be prohibited under Article 9(4) of the GDPR. Article 24 Processing of personal data for other purposes by public bodies 1. The processing of personal data by public bodies for a purpose other than that for which they were collected shall be permitted where such processing is necessary for the performance of the tasks assigned to them and provided that it is necessary: (a) for the verification of the information provided by the data subject because there are reasonable grounds for believing that such information is incorrect; (b) for the prevention of risks to national security, defence or public security, or for securing tax and customs revenue; (c) for the prosecution of criminal offences; (d) for the prevention of serious harm to the rights of another person; (e) for the production of official statistics. 2. The processing of special categories of personal data, as referred to in Article 9(1) of the GDPR, for a purpose other than that for which they have been collected, shall be permitted provided that the conditions set out in the previous paragraph are fulfilled and one of the exemptions provided for in Article 9(2) of the GDPR or Article 22 of this Law applies.