A person shall not process sensitive personal data —
(a) except in cases provided for —
(i) in subsection (2) of section 34 or sections 36, 37 and 38,
(ii) in regulations prescribed by the Minister having regard to the public interest; or
(b) unless the data subject —
(i) has given his or her explicit consent to the processing, or
(ii) has published the personal data.