unless and until each individual who is a data subject of the personal data the subject of that procedure has given his prescribed consent to the procedure being carried out;

unless and until the Commissioner has consented under section 32 to the procedure being carried out;

unless the procedure-

1. belongs to a class of matching procedures specified in a notice under subsection (2); and
2. is carried out in accordance with the conditions, if any, specified in the notice; or

a class of matching procedures;

subject to subsection (3), the conditions, if any, subject to which a matching procedure belonging to that class shall be carried out.

such bodies representative of data users to which the conditions will apply (whether in whole or in part); and

such other interested persons,

unless the data user has served a notice in writing on the individual-

1. specifying the adverse action it proposes to take and the reasons therefor; and
2. stating that the individual has 7 days after the receipt of the notice within which to show cause why that action should not be taken; and

until the expiration of those 7 days.