Must an organization always provide explicit (opt-in) choice with respect to sensitive data?
No, such choice is not required where the processing is:
1. in the vital interests of the data subject or another person;
2. necessary for the establishment of legal claims or defenses;
3. required to provide medical care or diagnosis;
4. carried out in the course of legitimate activities by a foundation, association or any other non-profit body with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members of the body or to the persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subjects;
5. necessary to carry out the organization's obligations in the field of employment law; or
6. related to data that are manifestly made public by the individual.