Author: Accessible Law

Section 30 Authorisation concerning data subject’s trade union membership

  1. The prohibition on processing personal information concerning a data subject’s trade union membership, as referred to in section 26, does not apply to the processing by the trade union to which the data subject belongs or the trade union federation to which that trade union belongs, if such processing is necessary to achieve the aims of the trade union or trade union federation.
  2. In the cases referred to under subsection (1), no personal information may be supplied to third parties without the consent of the data subject.

Section 31 Authorisation concerning data subject’s political persuasion

  1. The prohibition on processing personal information concerning a data subject’s political persuasion, as referred to in section 26, does not apply to processing by or for an institution, founded on political principles, of the personal information of—
    1. its members or employees or other persons belonging to the institution, if such processing is necessary to achieve the aims or principles of the institution; or
    2. a data subject if such processing is necessary for the purposes of—
      1. forming a political party;
      2. participating in the activities of, or engaging in the recruitment of members for or canvassing supporters or voters for, a political party with the view to—
        1. an election of the National Assembly or the provincial legislature as regulated in terms of the Electoral Act, 1998 (Act No. 73 of 1998);
        2. municipal elections as regulated in terms of the Local Government: Municipal Electoral Act, 2000 (Act No. 27 of 2000); or
        3. a referendum as regulated in terms of the Referendums Act, 1983 (Act No. 108 of 1983); or
      3. campaigning for a political party or cause.
  2. In the cases referred to under subsection (1), no personal information may be supplied to third parties without the consent of the data subject.

Section 32 Authorisation concerning data subject’s health or sex life

  1. The prohibition on processing personal information concerning a data subject’s health or sex life, as referred to in section 26, does not apply to the processing by—
    1. medical professionals, healthcare institutions or facilities or social services, if such processing is necessary for the proper treatment and care of the data subject, or for the administration of the institution or professional practice concerned;
    2. insurance companies, medical schemes, medical scheme administrators and managed healthcare organisations, if such processing is necessary for—
      1. assessing the risk to be insured by the insurance company or covered by the medical scheme and the data subject has not objected to the processing;
      2. the performance of an insurance or medical scheme agreement; or
      3. the enforcement of any contractual rights and obligations;
    3. schools, if such processing is necessary to provide special support for pupils or making special arrangements in connection with their health or sex life;
    4. any public or private body managing the care of a child if such processing is necessary for the performance of their lawful duties;
    5. any public body, if such processing is necessary in connection with the implementation of prison sentences or detention measures; or
    6. administrative bodies, pension funds, employers or institutions working for them, if such processing is necessary for—
      1. the implementation of the provisions of laws, pension regulations or collective agreements which create rights dependent on the health or sex life of the data subject; or
      2. the reintegration of or support for workers or persons entitled to benefit in connection with sickness or work incapacity.
  2. In the cases referred to under subsection (1), the information may only be processed by responsible parties subject to an obligation of confidentiality by virtue of office, employment, profession or legal provision, or established by a written agreement between the responsible party and the data subject.
  3. A responsible party that is permitted to process information concerning a data subject’s health or sex life in terms of this section and is not subject to an obligation of confidentiality by virtue of office, profession or legal provision, must treat the information as confidential, unless the responsible party is required by law or in connection with their duties to communicate the information to other parties who are authorised to process such information in accordance with subsection (1).
  4. The prohibition on processing any of the categories of personal information referred to in section 26, does not apply if it is necessary to supplement the processing of personal information concerning a data subject’s health, as referred to under subsection (1)(a), with a view to the proper treatment or care of the data subject.
  5. Personal information concerning inherited characteristics may not be processed in respect of a data subject from whom the information concerned has been obtained, unless—
    1. a serious medical interest prevails; or
    2. the processing is necessary for historical, statistical or research activity.
  6. More detailed rules may be prescribed concerning the application of subsection (1)(b) and (f).

Section 33 Authorisation concerning data subject’s criminal behaviour or biometric information

  1. The prohibition on processing personal information concerning a data subject’s criminal behaviour or biometric information, as referred to in section 26, does not apply if the processing is carried out by bodies charged by law with applying criminal law or by responsible parties who have obtained that information in accordance with the law.
  2. The processing of information concerning personnel in the service of the responsible party must take place in accordance with the rules established in compliance with labour legislation.
  3. The prohibition on processing any of the categories of personal information referred to in section 26 does not apply if such processing is necessary to supplement the processing of information on criminal behaviour or biometric information permitted by this section.

Section 35 General authorisation concerning personal information of children

  1. The prohibition on processing personal information of children, as referred to in section 34, does not apply if the processing is—
    1. carried out with the prior consent of a competent person;
    2. necessary for the establishment, exercise or defence of a right or obligation in law;
    3. necessary to comply with an obligation of international public law;
    4. for historical, statistical or research purposes to the extent that—
      1. the purpose serves a public interest and the processing is necessary for the purpose concerned; or
      2. it appears to be impossible or would involve a disproportionate effort to ask for consent,
      3. and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the child to a disproportionate extent; or
    5. of personal information which has deliberately been made public by the child with the consent of a competent person.
  2. The Regulator may, notwithstanding the prohibition referred to in section 34, but subject to subsection (3), upon application by a responsible party and by notice in theGazette, authorise a responsible party to process the personal information of children if the processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the child.
  3. The Regulator may impose reasonable conditions in respect of any authorisation granted under subsection (2), including conditions with regard to how a responsible party must—
    1. upon request of a competent person provide a reasonable means for that person to—
      1. review the personal information processed; and
      2. refuse to permit its further processing;
    2. provide notice—
      1. regarding the nature of the personal information of children that is processed;
      2. how such information is processed; and
      3. regarding any further processing practices;
    3. refrain from any action that is intended to encourage or persuade a child to disclose more personal information about him- or herself than is reasonably necessary given the purpose for which it is intended; and
    4. establish and maintain reasonable procedures to protect the integrity and confidentiality of the personal information collected from children.

Section 37 Regulator may exempt processing of personal information

  1. The Regulator may, by notice in the Gazette, grant an exemption to a responsible party to process personal information, even if that processing is in breach of a condition for the processing of such information, or any measure that gives effect to such condition, if the Regulator is satisfied that, in the circumstances of the case—
    1. the public interest in the processing outweighs, to a substantial degree, any interference with the privacy of the data subject that could result from such processing; or
    2. the processing involves a clear benefit to the data subject or a third party that outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing.
  2. The public interest referred to in subsection (1) includes—
    1. the interests of national security;
    2. the prevention, detection and prosecution of offences;
    3. important economic and financial interests of a public body;
    4. fostering compliance with legal provisions established in the interests referred to under paragraphs (b) and (c);
    5. historical, statistical or research activity; or
    6. the special importance of the interest in freedom of expression.
  3. The Regulator may impose reasonable conditions in respect of any exemption granted under subsection (1).

Section 38 Exemption in respect of certain functions

  1. Personal information processed for the purpose of discharging a relevant function is exempt from sections 11(3) and (4), 12, 15 and 18 in any case to the extent to which the application of those provisions to the personal information would be likely to prejudice the proper discharge of that function.
  2. ‘‘Relevant function’’ for purposes of subsection (1), means any function—
    1. of a public body; or
    2. conferred on any person in terms of the law,
    3. which is performed with the view to protecting members of the public against
      1. financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate; or
      2. dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons authorised to carry on any profession or other activity.

Section 39 Establishment of Information Regulator

  1. There is hereby established a juristic person to be known as the Information Regulator, which—
    1. has jurisdiction throughout the Republic;
    2. is independent and is subject only to the Constitution and to the law and must be impartial and perform its functions and exercise its powers without fear, favour or prejudice;
    3. must exercise its powers and perform its functions in accordance with this Act and the Promotion of Access to Information Act; and
    4. is accountable to the National Assembly.