4 (2) corporation on a regular basis and in the context of the stated purposes of the association or corporation, and where the data is not disclosed to a third party without the consent of the data subject; (8) the processing of data on trade-union membership in the operations of a trade union or a federation of trade unions, where the data relate to the members of the union or federation or to persons connected to the union or federation on a regular basis and in the context of the stated purposes of the union or federation, and where the data is not disclosed to a third party without the consent of the data subject; (9) the processing of data on trade-union membership, where necessary for the observation of the special rights and duties of the controller in the field of labour law; (10) a health care unit or a health care professional from processing data collected in the course of their operations and relating to the state of health, illness or handicap of the data subject or the treatment or other measures directed at the data subject, or other data which are indispensable in the treatment of the data subject; (11) an insurer from processing data collected in the course of its insurance activity and relating to the state of health, illness or handicap of the policyholder/claimant or the treatment or other measures directed at the policyholder/claimant, or data on the criminal act, punishment or other sanction of the policyholder/claimant or the person causing the damage, where necessary for the determination of the liability of the insurer; (12) a social welfare authority or another authority, institution or private producer of social services granting social welfare benefits from processing data collected in the course of their operations and relating to the social welfare needs of the data subject or the benefits, support or other social welfare assistance received by the person or otherwise indispensable for the welfare of the data subject; or processing of data where the Data Protection Board has issued a permission for the same, as provided in section 43(2). Sensitive data shall be erased from the data file immediately when there no longer is a reason for its processing, as provided in paragraph (1). The reason and the need for processing shall be re-evaluated at five-year intervals at the longest, unless otherwise provided in an Act or stated in a permission of the Data Protection Board referred to in paragraph (1)(13). Section 13 — Processing of a personal identity number (1) A personal identity number may be processed on the unambiguous consent of the data subject or where so provided in an Act. A personal identity number may also be processed if it is necessary to unambiguously identify the data subject: (1) in order to perform a task laid down in an Act; (2) in order to realise the rights or duties of the data subject or the controller; or (3) for purposes of historical, scientific or statistical research. (2) A personal identity number may be processed in activities relating to the granting of credit and the collection of debt, in the insurance, credit, renting and lending businesses, in credit data operations, in health care, in social welfare activities or other social services and in matters relating to the civil service, employment and other service relationships and benefits relating to the same. (3) In addition to the provisions on processing in paragraphs (1) and (2), a personal identity number may be disclosed for the purposes of updating of address information and prevention of redundant postal traffic, provided that the personal identity number is already available to the recipient. (4) The controller shall see to that the personal identity number is not unnecessarily included in hard copies printed or drawn up from the personal data file. Chapter 4 — Processing of personal data for special purposes Section 14 — Research (1) Personal data may be processed for purposes of historical or scientific research also for a reason not referred to in section 8(1), if: (1) the research cannot be carried out without data identifying the person and the consent of the data subjects cannot be obtained owing to the quantity of the data, their age or