(1) Genetic testing shall not be carried out on a person unless -

(a) the testing is not prohibited by law, and

(b) the consent of the person to the processing of any genetic data to be derived from the testing has been obtained in accordance with the Data Protection Regulation.

(2) A person shall not engage in the processing of genetic data in relation to -

(a) the employment of a person,

(b) a policy of insurance or life assurance,

(c) a policy of health insurance or health-related insurance,

(d) an occupational pension, a retirement annuity contract or any other pension arrangement,

(e) the mortgaging of property.

(3) A person shall not process genetic data unless all reasonable steps have been taken to provide the data subject with all appropriate information concerning -

(a) the purpose and possible outcomes of the proposed processing, and