(1) Private bodies shall be permitted to process personal data for a purpose other than the one for which the data were collected if
- processing is necessary to prevent threats to state or public security or to prosecute criminal offences; or
- processing is necessary for the establishment, exercise or defence of legal claims,
unless the data subject has an overriding interest in not having the data processed.
(2) The processing of special categories of personal data as referred to in Article 9 (1) of Regulation (EU) 2016/679 for a purpose other than the one for which the data were collected shall be permitted if the conditions of subsection 1 are met and an exception pursuant to Article 9 (2) of Regulation (EU) 2016/679 or pursuant to Section 22 applies.
