b) c) d) e) f) to enable the controller to fulfil a legal obligation, to protect the vital interests of the data subject, to perform a task in the public interest, to exercise official authority, or to enable the controller or third parties to whom the data are disclosed to protect a legitimate interest, except where such interest is overridden by the interests of the data subject. Section 9 Processing of sensitive personal data Sensitive personal data (cf. section 2, no.8) may only be processed if the processing satisfies one of the conditions set out in section 8 and a) the data subject consents to the processing, b) there is statutory authority for such processing, c) the processing is necessary to protect the vital interests of a person, and the data subject is incapable of giving his or her consent, d) the processing relates exclusively to data which the data subject has voluntarily and manifestly made public, e) the processing is necessary for the establishment, exercise or defence of a legal claim, f) the processing is necessary to enable the controller to fulfil his obligations or exercise his rights in the field of employment law, g) the processing is necessary for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health care services, and where the data are processed by health professionals subject to the obligation of professional secrecy, or h) the processing is necessary for historical, statistical or scientific purposes, and the public interest in such processing being carried out clearly exceeds the disadvantages it might entail for the natural person. Non-profit associations and foundations may process sensitive personal data in the course of their activities even if such processing does not satisfy one of the conditions laid down in the first paragraph, litra a-h. Such processing may apply solely to data relating to members or to persons who, on account of the purposes of the association or foundation, voluntarily have regular contact with it, and solely to data which are collected through such contact. The personal data may not be disclosed without the consent of the data subject. The Data Inspectorate may decide that sensitive personal data may also be processed in other cases if this is warranted by important public interests and steps are taken to protect the interests of the data subject. Section 10 Register of criminal convictions A complete register of criminal convictions may only be kept under the control of official authority. Section 11 Basic requirements for the processing of personal data The controller shall ensure that personal data which are processed a) are processed only when this is authorized pursuant to sections 8 and 9, b) are used only for explicitly stated purposes that are objectively justified by the activities of the controller, c) are not used subsequently for purposes that are incompatible with the original purpose of the collection, without the consent of the data subject,