Section 9 Lawfulness of processing

  1. Personal information must be processed—
    1. lawfully; and
    2. in a reasonable manner that does not infringe the privacy of the data subject