Data Protection Act (Cap. 586), article 7

7. A controller shall consult with, and obtain prior authorisation from, the Commission er where the controller inten ds to process in the public interest: (a) genetic data, biometric data or data concerning health for statistical or research purposes; or (b) special categories of data in relation to the management of social care services and systems, including for the purposes of quality control, management information and the general national supervision and monitoring of such services and systems: Provided that, where genetic d ata, biometric data or data concerning health are required to be processed for research pur poses, the Commissioner shall consult a research ethics committee or o f an institution recognised by the Commissioner for the purposes of this article. Processing of an identity document.