Category: POPIA

Section 28 Authorisation concerning data subject’s religious or philosophical beliefs

  1. The prohibition on processing personal information concerning a data subject’s religious or philosophical beliefs, as referred to in section 26, does not apply if the processing is carried out by—
    1. spiritual or religious organisations, or independent sections of those organisations if—
      1. the information concerns data subjects belonging to those organisations;
      2. or
      3. it is necessary to achieve their aims and principles;
    2. institutions founded on religious or philosophical principles with respect to their members or employees or other persons belonging to the institution, if it is necessary to achieve their aims and principles; or
    3. other institutions: Provided that the processing is necessary to protect the spiritual welfare of the data subjects, unless they have indicated that they object to the processing.
  2. In the cases referred to in subsection (1)(a), the prohibition does not apply to processing of personal information concerning the religion or philosophy of life of family members of the data subjects, if—
    1. the association concerned maintains regular contact with those family members in connection with its aims; and
    2. the family members have not objected in writing to the processing.
  3. In the cases referred to in subsections (1) and (2), personal information concerning a data subject’s religious or philosophical beliefs may not be supplied to third parties without the consent of the data subject.

Section 29 Authorisation concerning data subject’s race or ethnic origin

  1. The prohibition on processing personal information concerning a data subject’s race or ethnic origin, as referred to in section 26, does not apply if the processing is carried out to—
    1. identify data subjects and only when this is essential for that purpose; and
    2. comply with laws and other measures designed to protect or advance persons, or categories of persons, disadvantaged by unfair discrimination.

Section 30 Authorisation concerning data subject’s trade union membership

  1. The prohibition on processing personal information concerning a data subject’s trade union membership, as referred to in section 26, does not apply to the processing by the trade union to which the data subject belongs or the trade union federation to which that trade union belongs, if such processing is necessary to achieve the aims of the trade union or trade union federation.
  2. In the cases referred to under subsection (1), no personal information may be supplied to third parties without the consent of the data subject.

Section 31 Authorisation concerning data subject’s political persuasion

  1. The prohibition on processing personal information concerning a data subject’s political persuasion, as referred to in section 26, does not apply to processing by or for an institution, founded on political principles, of the personal information of—
    1. its members or employees or other persons belonging to the institution, if such processing is necessary to achieve the aims or principles of the institution; or
    2. a data subject if such processing is necessary for the purposes of—
      1. forming a political party;
      2. participating in the activities of, or engaging in the recruitment of members for or canvassing supporters or voters for, a political party with the view to—
        1. an election of the National Assembly or the provincial legislature as regulated in terms of the Electoral Act, 1998 (Act No. 73 of 1998);
        2. municipal elections as regulated in terms of the Local Government: Municipal Electoral Act, 2000 (Act No. 27 of 2000); or
        3. a referendum as regulated in terms of the Referendums Act, 1983 (Act No. 108 of 1983); or
      3. campaigning for a political party or cause.
  2. In the cases referred to under subsection (1), no personal information may be supplied to third parties without the consent of the data subject.

Section 32 Authorisation concerning data subject’s health or sex life

  1. The prohibition on processing personal information concerning a data subject’s health or sex life, as referred to in section 26, does not apply to the processing by—
    1. medical professionals, healthcare institutions or facilities or social services, if such processing is necessary for the proper treatment and care of the data subject, or for the administration of the institution or professional practice concerned;
    2. insurance companies, medical schemes, medical scheme administrators and managed healthcare organisations, if such processing is necessary for—
      1. assessing the risk to be insured by the insurance company or covered by the medical scheme and the data subject has not objected to the processing;
      2. the performance of an insurance or medical scheme agreement; or
      3. the enforcement of any contractual rights and obligations;
    3. schools, if such processing is necessary to provide special support for pupils or making special arrangements in connection with their health or sex life;
    4. any public or private body managing the care of a child if such processing is necessary for the performance of their lawful duties;
    5. any public body, if such processing is necessary in connection with the implementation of prison sentences or detention measures; or
    6. administrative bodies, pension funds, employers or institutions working for them, if such processing is necessary for—
      1. the implementation of the provisions of laws, pension regulations or collective agreements which create rights dependent on the health or sex life of the data subject; or
      2. the reintegration of or support for workers or persons entitled to benefit in connection with sickness or work incapacity.
  2. In the cases referred to under subsection (1), the information may only be processed by responsible parties subject to an obligation of confidentiality by virtue of office, employment, profession or legal provision, or established by a written agreement between the responsible party and the data subject.
  3. A responsible party that is permitted to process information concerning a data subject’s health or sex life in terms of this section and is not subject to an obligation of confidentiality by virtue of office, profession or legal provision, must treat the information as confidential, unless the responsible party is required by law or in connection with their duties to communicate the information to other parties who are authorised to process such information in accordance with subsection (1).
  4. The prohibition on processing any of the categories of personal information referred to in section 26, does not apply if it is necessary to supplement the processing of personal information concerning a data subject’s health, as referred to under subsection (1)(a), with a view to the proper treatment or care of the data subject.
  5. Personal information concerning inherited characteristics may not be processed in respect of a data subject from whom the information concerned has been obtained, unless—
    1. a serious medical interest prevails; or
    2. the processing is necessary for historical, statistical or research activity.
  6. More detailed rules may be prescribed concerning the application of subsection (1)(b) and (f).

Section 33 Authorisation concerning data subject’s criminal behaviour or biometric information

  1. The prohibition on processing personal information concerning a data subject’s criminal behaviour or biometric information, as referred to in section 26, does not apply if the processing is carried out by bodies charged by law with applying criminal law or by responsible parties who have obtained that information in accordance with the law.
  2. The processing of information concerning personnel in the service of the responsible party must take place in accordance with the rules established in compliance with labour legislation.
  3. The prohibition on processing any of the categories of personal information referred to in section 26 does not apply if such processing is necessary to supplement the processing of information on criminal behaviour or biometric information permitted by this section.

Section 37 Regulator may exempt processing of personal information

  1. The Regulator may, by notice in the Gazette, grant an exemption to a responsible party to process personal information, even if that processing is in breach of a condition for the processing of such information, or any measure that gives effect to such condition, if the Regulator is satisfied that, in the circumstances of the case—
    1. the public interest in the processing outweighs, to a substantial degree, any interference with the privacy of the data subject that could result from such processing; or
    2. the processing involves a clear benefit to the data subject or a third party that outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing.
  2. The public interest referred to in subsection (1) includes—
    1. the interests of national security;
    2. the prevention, detection and prosecution of offences;
    3. important economic and financial interests of a public body;
    4. fostering compliance with legal provisions established in the interests referred to under paragraphs (b) and (c);
    5. historical, statistical or research activity; or
    6. the special importance of the interest in freedom of expression.
  3. The Regulator may impose reasonable conditions in respect of any exemption granted under subsection (1).

Section 38 Exemption in respect of certain functions

  1. Personal information processed for the purpose of discharging a relevant function is exempt from sections 11(3) and (4), 12, 15 and 18 in any case to the extent to which the application of those provisions to the personal information would be likely to prejudice the proper discharge of that function.
  2. ‘‘Relevant function’’ for purposes of subsection (1), means any function—
    1. of a public body; or
    2. conferred on any person in terms of the law,
    3. which is performed with the view to protecting members of the public against
      1. financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate; or
      2. dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons authorised to carry on any profession or other activity.