Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
44
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
44
of personal information concerning a data subject’s health, as referred to under
subsection (1)(a), with a view to the proper treatment or care of the data subject.
(5) Personal information concerning inherited characteristics may not be processed in
respect of a data subject from whom the information concerned has been obtained,
unless—
(a) a serious medical interest prevails; or
(b) the processing is necessary for historical, statistical or research activity.
(6) More detailed rules may be prescribed concerning the application of subsection
(1)(b) and (f).
5
Authorisation concerning data subject’s criminal behaviour or biometric informa- 10
tion
33. (1) The prohibition on processing personal information concerning a data
subject’s criminal behaviour or biometric information, as referred to in section 26, does
not apply if the processing is carried out by bodies charged by law with applying
criminal law or by responsible parties who have obtained that information in accordance 15
with the law.
(2) The processing of information concerning personnel in the service of the
responsible party must take place in accordance with the rules established in compliance
with labour legislation.
(3) The prohibition on processing any of the categories of personal information 20
referred to in section 26 does not apply if such processing is necessary to supplement the
processing of information on criminal behaviour or biometric information permitted by
this section.
Part C
Processing of personal information of children
25
Prohibition on processing personal information of children
34. A responsible party may, subject to section 35, not process personal information
concerning a child.
General authorisation concerning personal information of children
35. (1) The prohibition on processing personal information of children, as referred to
in section 34, does not apply if the processing is—
(a) carried out with the prior consent of a competent person;
(b) necessary for the establishment, exercise or defence of a right or obligation in
law;
(c) necessary to comply with an obligation of international public law;
(d) for historical, statistical or research purposes to the extent that—
(i) the purpose serves a public interest and the processing is necessary for
the purpose concerned; or
(ii) it appears to be impossible or would involve a disproportionate effort to
ask for consent,
and sufficient guarantees are provided for to ensure that the processing does
not adversely affect the individual privacy of the child to a disproportionate
extent; or
(e) of personal information which has deliberately been made public by the child
with the consent of a competent person.
(2) The Regulator may, notwithstanding the prohibition referred to in section 34, but
subject to subsection (3), upon application by a responsible party and by notice in the
Gazette, authorise a responsible party to process the personal information of children if
the processing is in the public interest and appropriate safeguards have been put in place
to protect the personal information of the child.
(3) The Regulator may impose reasonable conditions in respect of any authorisation
granted under subsection (2), including conditions with regard to how a responsible
party must—
30
35
40
45
50