(1) Subject to subsection (2), the Ministry shall not process health information unless the Ministry has obtained the express consent of the person.
(2) Notwithstanding subsection (1), the Ministry may process health information without obtaining the express consent of the person and with a court order, where the processing is necessary —
(a) in order to protect the health of the person;
(b) for the performance of an activity that is carried out in the public interest or in the exercise of official authority vested in the Ministry or in a third party to whom the health information is disclosed;
(c) for a purpose that the Ministry or a third party to whom health information is provided, except where the purpose is overridden by the interest to protect the fundamental rights and freedoms of the person and in particular the right to privacy.