Without prejudice to the principles set out in this Act, data processing shall be lawful, where — (a) the data subject has given and not withdrawn consent for the specific purpose or purposes for which personal data is to be processed; or (b) t...

Interests in personal data processing shall not be legitimate for the purposes of subsection (1)(b)(v), where — (a) they override the fundamental rights, freedoms and the interests of the data subject; (b) they are incompatible with other lawful b...