Subsection (1) shall not apply, where the decision is —

(a) necessary for entering into or the performance of a contract between the data subject and a data controller;

(b) authorised by a written law, which establishes suitable measures to safeguard the fundamental rights and freedoms, and the interests of the data subject; or

(c) authorised by the consent of the data subject.