Notification to data subject when collecting personal information

Notification to data subject when collecting personal information

18. (1) If personal information is collected, the responsible party must take reasonably
practicable steps to ensure that the data subject is aware of—
(a) the information being collected and where the information is not collected
from the data subject, the source from which it is collected;
(b) the name and address of the responsible party;
(c) the purpose for which the information is being collected;
(d) whether or not the supply of the information by that data subject is voluntary
or mandatory;
(e) the consequences of failure to provide the information;
(f) any particular law authorising or requiring the collection of the information;
(g) the fact that, where applicable, the responsible party intends to transfer the
information to a third country or international organisation and the level of
protection afforded to the information by that third country or international
(h) any further information such as the—
(i) recipient or category of recipients of the information;
(ii) nature or category of the information;
(iii) existence of the right of access to and the right to rectify the information
(iv) existence of the right to object to the processing of personal information
as referred to in section 11(3); and
(v) right to lodge a complaint to the Information Regulator and the contact
details of the Information Regulator,
which is necessary, having regard to the specific circumstances in which the
information is or is not to be processed, to enable processing in respect of the
data subject to be reasonable.

(2) The steps referred to in subsection (1) must be taken—
(a) if the personal information is collected directly from the data subject, before
the information is collected, unless the data subject is already aware of the
the information referred to in that subsection; or (b) in any other case, before the information is collected or as soon as reasonably practicable after it has been collected.

(3) A responsible party that has previously taken the steps referred to in subsection (1)
complies with subsection (1) in relation to the subsequent collection from the data
subject of the same information or information of the same kind if the purpose of
collection of the information remains the same.

(4) It is not necessary for a responsible party to comply with subsection (1) if—
(a) the data subject or a competent person where the data subject is a child has
provided consent for the non-compliance;
(b) non-compliance would not prejudice the legitimate interests of the data
subject as set out in terms of this Act;
(c) non-compliance is necessary—
(i) to avoid prejudice to the maintenance of the law by any public body,
including the prevention, detection, investigation, prosecution and
punishment of offences;
(ii) to comply with an obligation imposed by law or to enforce legislation
concerning the collection of revenue as defined in section 1 of the South
African Revenue Service Act, 1997 (Act No. 34 of 1997);
(iii) for the conduct of proceedings in any court or tribunal that have been
commenced or are reasonably contemplated; or
(iv) in the interests of national security;
(d) compliance would prejudice a lawful purpose of the collection;
(e) compliance is not reasonably practicable in the circumstances of the particular
case; or
(f) the information will—
(i) not be used in a form in which the data subject may be identified; or
(ii) be used for historical, statistical or research purposes.

Please follow and like us:

© 2022. Information Regulator South Africa / Terms and Conditions