(1) Personal data shall not be processed without explicit consent of the data subject.

(2) Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met:

• a) It is expressly provided for by the laws.
• b) It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.
• c) Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
• ç) It is necessary for compliance with a legal obligation to which the data controller is subject.
• d) Personal data have been made public by the data subject himself/herself.
• e) Data processing is necessary for the establishment, exercise or protection of any right.
• f) Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.