Skip to content

Part 4 » Principles and Rules Relating to Processing of Personal Data

12. Principles relating to processing of personal data

  1. A data controller or data processor shall ensure that personal data is —

    1. processed lawfully, fairly and transparently;
    2. collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
    3. adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
    4. accurate and where necessary, kept up to date, with every reasonable step taken to ensure that any inaccurate personal data is erased or rectified without delay;
    5. stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;
    6. processed in accordance with the rights of a data subject; and
    7. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against any loss, destruction or damage, using appropriate technical or organisational measures.

  2. For the purposes of subsection 1(b), processing of personal data for purposes of archiving in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purpose.

13. Processing of personal data

Subject to the other provisions of this Act, a data controller may process personal data where —

  1. the data subject has given consent to the processing of that data subject’s personal data;
  2. the processing is necessary —
    1. for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
    2. for compliance with a legal obligation to which the data controller is subject;
    3. in order to protect the vital interests of the data subject or of another natural person;
    4. for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
    5. for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child; or
  3. the processing relates to personal data which is manifestly made public by the data subject.

14. Processing of sensitive personal data

  1. A person shall not process sensitive personal data, unless—

    1. processing is necessary for the establishment, exercise or defence of a legal claim or whenever a court is exercising a judicial function;
    2. processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services ;or
    3. processing is necessary for reasons of public interest.

  2. Personal data under subsection (1)(b) may be processed when the data is processed by or under the responsibility of a professional, subject to secrecy and other obligations imposed by any law or professional bodies regulating them.

  3. Personal data referred to under subsection (1) © shall be processed only where adequate measures to safeguard the rights and freedoms of the data subject have been put in place.

  1. A data controller shall not process personal data unless the data subject consents to the processing.
  2. A data subject may consent to the processing of that data subject’s personal data in writing.
  3. Prior to giving consent, the data subject shall be informed of the data subject’s right to withdraw the consent.
  4. A data controller shall, where processing is based on consent, demonstrate that the data subject has consented to the processing.
  5. Where a data subject consents in the form of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
  6. A data subject shall have the right to withdraw consent at any time.
  7. The withdrawal of consent shall not affect the lawfulness of processing based on consent under subsection (5) before its withdrawal and all personal data collected following withdrawal of the consent shall, subject to the provisions of this Act, be destroyed immediately.
  8. A data subject may object, at any time, to the processing of that data subject’s personal data.
  9. Where a data subject has objected to the processing of that data subject’s personal data, the data controller or data processor shall no longer process that personal data.

16. Collection of personal data

  1. Subject to subsection (2), a data controller shall collect personal data directly from a data subject.

  2. A data controller may collect personal data from a source other than the data subject if —

    1. the data is contained in or derived from a public record or has intentionally been made public by the data subject;
    2. the data subject has consented to the collection of data from another source;
    3. collection of data from another source would not prejudice the interest of the data subject;

    4. collection of data from another source is necessary—

      1. to avoid prejudice to the maintenance of the law and order by any public body, including the prevention, detection, investigation, prosecution and punishment of an offence;
      2. to comply with an obligation imposed by law; or
      3. for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; or
      4. for the purposes of national security;

    5. collection from the data subject would prejudice a lawful purpose of the collection;

    6. compliance is not reasonably practicable in the circumstances of the particular case; or

    7. it is —

      1. necessary for the provision of an emergency medical service to the data subject;
      2. required for the establishment of the identity of the data subject and the collection is authorised by a law written for that purpose;
      3. necessary to prevent a reasonable threat to national security, defence or public order; or
      4. necessary to prevent, investigate or prosecute a cognisable offence.

17. Processing of child and vulnerable person’s personal data

  1. Where a data subject is a child or a vulnerable person, that data subject’s right may be exercised by that data subject’s parents, legal guardian or a person exercising parental responsibility as the case may be.
  2. A data controller shall not process a child’s or vulnerable person’s personal data unless consent is given by the child’s or vulnerable person’s parent, legal guardian or a person exercising parental responsibility.
  3. A data controller shall, where the personal data of a child or a vulnerable person is involved, make every reasonable effort to verify that consent has been given or authorised, taking into account available technology.
  4. A data controller shall incorporate appropriate mechanisms for age verification and parental consent in the processing of personal data of a child.

18. Offence and penalty for contravention of personal data obligation

  1. A body corporate that contravenes the provisions of this Part commits an offence and is liable on conviction to —

    1. a fine not exceeding one hundred million penalty units; or
    2. two percent of annual turnover of the preceding financial year, whichever is higher.

  2. Where the offence is committed by a natural person, that person shall be liable, on conviction to a fine not exceeding one million penalty units or to imprisonment for a term not exceeding five years, or to both.