17
(1) A person shall collect personal information directly from the data subject,
except where –
(a) The information is contained in a public record or has deliberately
been made public by the data subject;
(b) The data subject has consented to the collection of the information
from another source;
(c) Collection of the information from another source would not
prejudice a legitimate interest of the data subject;
(d) Collection of the information from another source is necessary –
(i)
To avoid prejudice to the maintenance or enforcement of
the law and order;
(ii)
For the conduct of proceedings in any court or tribunal
that have commenced or are reasonably contemplated;
(iii)
In the legitimate interests of national security;
(iv)
To maintain the legitimate interests of the data
controller or of a third party to whom the information is
supplied
(e) Compliance would prejudice a lawful purpose of the collection; or
(f) Compliance is not reasonably practicable in the circumstances of the
particular case.
Purpose specification and further processing limitation
18
(1) Personal data shall be collected for specified, explicit and legitimate
purposes and shall not be further processed in a way incompatible with