13.

Consent required

An organisation shall not, on or after the appointed day, collect, use or disclose personal data about an individual unless —
(a) the individual gives, or is deemed to have given, his consent under this Act to the collection, use or disclosure, as the case may be; or
(b) the collection, use or disclosure, as the case may be, without the consent of the individual is required or authorised under this Act or any other written law.