Article 6 Legal criteria for processing 1. The personal data may be processed only if: a) personal data subject has given his consent; b) processing is necessary for the performance of a contract to which the data subject is party or in order to negotiate or amend a draft/contract at the request of the data subject; c) in order to protect the vital interests of the data subject; ç) to comply with a legal obligation of the controller; d) for the performance of a legal task of public interest or in exercise of powers of the controller or of a third party to whom the data are disclosed; dh) processing is necessary for the protection of the legitimate rights and interests of the controller, the recipient or any other interested party. However, in any case, processing of personal data cannot be in clear contradiction with the data subject right to protection of personal life and privacy. 2. Processing of personal data in the framework of crime prevention and prosecution activities, in cases of a criminal offence against the public order and other violations in the field of criminal law, defence and national security, shall be performed by official authorities as stipulated in the law. 3. In the event, the controller or processor carries out personal data processing for the purpose of offering business opportunities or services provided that the data were taken from a public list of data. The controller or processor cannot process further the data specified in this paragraph, if the data subject has expressed his disagreement or has objected their further processing. No additional personal data is attached to the data specified above without the consent of the data subject. 12 4. The controller is allowed to keep in its own filing system the personal data even after the data subject has objected proceesing under paragraph 3 of this Article. Such data can be used only if the data subject gives his content. 5. Collection of personal data which is related to a data subject solely for reasons of direct marketing is allowed only if the data subject has given his explicit consent. Article 7 Processing of sensitive data 1. Except for cases specified in point 2 and 3 of this Article, processing of data that reveal racial or ethnic origin, political beliefs, trade unions membership, religious or philosophical beliefs, criminal convictions and health and sexual life is prohibited. 2. Processing of sensitive data shall be done only if: a) the data subject has given his consent, which may be revoked at any given moment making illegal any further processing of data; b) it is in the vital interest of the data subject or another person and the data subject is physically or mentally incapable of giving his/her consent; c) it is authorized by the responsible authority for an important public interest, under adequate safeguards; ç) It is related to data which are manifestly made public by the data subject or is necessary for the exercise or defence of legal rights; d) data are processed for historic, scientific or statistical research, under adequate safeguards; dh) data are required for the purposes of preventive medicine, medical diagnosis, the provision of health care, treatment or management of health care services and data 13