[No. 6.] S.8 Data Protection (Amendment) Act 2003. [2003.] (b) the damage or distress is or would be unwarranted. (2) This subsection applies to processing that is necessary— (a) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or in a third party to whom the data are or are to be disclosed, or (b) for the purposes of the legitimate interests pursued by the data controller to whom the data are or are to be disclosed, unless those interests are overridden by the interests of the data subject in relation to fundamental rights and freedoms and, in particular, his or her right to privacy with respect to the processing of personal data. (3) Subsection (1) does not apply— (a) in a case where the data subject has given his or her explicit consent to the processing, (b) if the processing is necessary— (i) for the performance of a contract to which the data subject is a party, (ii) in order to take steps at the request of the data subject prior to his or her entering into a contract, (iii) for compliance with any legal obligation to which the data controller or data subject is subject other than one imposed by contract, or (iv) to protect the vital interests of the data subject, (c) to processing carried out by political parties or candidates for election to, or holders of elective political office, in the course of electoral activities, or (d) in such other cases, if any, as may be specified in regulations made by the Minister after consultation with the Commissioner. (4) Where a notice under subsection (1) of this section is served on a data controller, he or she shall, as soon as practicable and in any event not later than 20 days after the receipt of the notice, serve a notice on the individual concerned— 22