1.

An organisation may disclose personal data about an individual without the consent of the individual in any of the following circumstances:
(a) the disclosure is necessary for any purpose which is clearly in the interests of the individual, if consent for its disclosure cannot be obtained in a timely way;
(b) the disclosure is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual;
(c) subject to the conditions in paragraph 2, there are reasonable grounds to believe that the health or safety of the individual or another individual will be seriously affected and consent for the disclosure of the data cannot be obtained in a timely way;
(d) the personal data is publicly available;
(e) the disclosure is necessary in the national interest;
(f) the disclosure is necessary for any investigation or proceedings;
(g) the disclosure is to a public agency and such disclosure is necessary in the public interest;
(h) the disclosure is necessary for evaluative purposes;
(i) the disclosure is necessary for the organisation to recover a debt owed by the individual to the organisation or for the organisation to pay to the individual a debt owed by the organisation;
(j) the disclosure is necessary for the provision of legal services by the organisation to another person or for the organisation to obtain legal services;
(k) the personal data is disclosed by a member of a credit bureau to the credit bureau for the purpose of preparing credit reports, or in a credit report provided by a credit bureau to a member of the credit bureau in relation to a transaction between the member and the individual;
(l) the personal data about the current or former students of the organisation, being an education institution, is disclosed to a public agency for the purposes of policy formulation or review;
(m) the personal data about the current or former patients of a healthcare institution licensed under the Private Hospitals and Medical Clinics Act (Cap. 248) or any other prescribed healthcare body is disclosed to a public agency for the purposes of policy formulation or review;
(n) the personal data is disclosed to any officer of a prescribed law enforcement agency, upon production of written authorisation signed by the head or director of that law enforcement agency or a person of a similar rank, certifying that the personal data is necessary for the purposes of the functions or duties of the officer;
(o) the disclosure is for the purpose of contacting the next of kin or a friend of any injured, ill or deceased individual;
(p) subject to the conditions in paragraph 3, the personal data —
(i) is disclosed to a party or a prospective party to a business asset transaction with the organisation;
(ii) is about an employee, customer, director, officer or shareholder of the organisation; and
(iii) relates directly to the part of the organisation or its business assets with which the business asset transaction is concerned;
(q) subject to the conditions in paragraph 4, the disclosure is for a research purpose, including historical or statistical research;
(r) the disclosure is for archival or historical purposes if a reasonable person would not consider the personal data to be too sensitive to the individual to be disclosed at the proposed time; or
(s) subject to the conditions in paragraph 5, the personal data —
(i) was collected by the organisation in accordance with section 17(1); and
(ii) is disclosed by the organisation for purposes consistent with the purpose of that collection.