Without prejudice to the principles set out in this Act, data processing shall be lawful, where —

(a) the data subject has given and not withdrawn consent for the specific purpose or purposes for which personal data is to be processed; or

(b) the processing is necessary —

(i) for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract,

(ii) for compliance with a legal obligation to which the data controller or data processor is subject,

(iii) to protect the vital interest of the data subject or another person,

(iv) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller or data processor, or

(v) for the purposes of the legitimate interests pursued by the data controller or data processor, or by a third party to whom the data is disclosed.