1.

An organisation may collect personal data about an individual without the consent of the individual or from a source other than the individual in any of the following circumstances:
(a) the collection is necessary for any purpose that is clearly in the interest of the individual, if consent for its collection cannot be obtained in a timely way or the individual would not reasonably be expected to withhold consent;
(b) the collection is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual;
(c) the personal data is publicly available;
(d) the collection is necessary in the national interest;
(e) the collection is necessary for any investigation or proceedings, if it is reasonable to expect that seeking the consent of the individual would compromise the availability or the accuracy of the personal data;
(f) the collection is necessary for evaluative purposes;
(g) the personal data is collected solely for artistic or literary purposes;
(h) subject to paragraph 2, the personal data is collected by a news organisation solely for its news activity;
(i) the personal data is collected for the organisation to recover a debt owed to the organisation by the individual or for the organisation to pay to the individual a debt owed by the organisation;
(j) the collection is necessary for the provision of legal services by the organisation to another person or for the organisation to obtain legal services;
(k) the personal data is collected by a credit bureau from a member of the credit bureau to create a credit report, or by a member of the credit bureau from a credit report provided by the credit bureau to that member in relation to a transaction between the member and the individual;
(l) the personal data is collected to confer an interest or a benefit on the individual under a private trust or a benefit plan, and to administer such trust or benefit plan, at the request of the settlor or the person establishing the benefit plan, as the case may be;
(m) the personal data was provided to the organisation by another individual to enable the organisation to provide a service for the personal or domestic purposes of that other individual;
(n) the personal data is included in a document —
(i) produced in the course, and for the purposes, of the individual’s employment, business or profession; and
(ii) collected for purposes consistent with the purposes for which the document was produced;
(o) the personal data is collected by the individual’s employer and the collection is reasonable for the purpose of managing or terminating an employment relationship between the organisation and the individual;
(p) subject to the conditions in paragraph 3, the personal data —
(i) is collected by an organisation, being a party or a prospective party to a business asset transaction with another organisation, from that other organisation;
(ii) is about an employee, customer, director, officer or shareholder of the other organisation; and
(iii) relates directly to the part of the other organisation or its business assets with which the business asset transaction is concerned;
(q) the personal data was disclosed by a public agency, and the collection is consistent with the purpose of the disclosure by the public agency; or
(r) the personal data —
(i) was disclosed to the organisation in accordance with section 17(3); and
(ii) is collected by the organisation for purposes consistent with the purpose of that disclosure.