The measure is allowed with the explicit consent of the data subject or if the processing is carried out on the basis of express legal provisions, with the establishment of appropriate measures to protect the rights, freedoms and legitimate interests of the data subject.