The following sections are inserted in the Principal Act after section 2:

"2A. Processing of personal data.

(1) Personal data shall not be processed by a data controller unless section 2 of this Act (as amended by the Act of 2003) is complied with by the data controller and at least one of the following conditions is met:

(a) the data subject has given his or her consent to the processing or, if the data subject, by reason of his or her physical or mental incapacity or age, is or is likely to be unable to appreciate the nature and effect of such consent, it is given by a parent or guardian or a grandparent, uncle, aunt, brother or sister of the data subject and the giving of such consent is not prohibited by law,

(b) the processing is necessary -

(i) for the performance of a contract to which the data subject is a party,

(ii) in order to take steps at the request of the data subject prior to entering into a contract,

(iii) for compliance with a legal obligation to which the data controller is subject other than an obligation imposed by contract, or

(iv) to prevent -

(I) injury or other damage to the health of the data subject, or

(II) serious loss of or damage to property of the data subject,