Topic 2: When is the Act NOT applicable? Copy

The Act does not apply –

• To the processing of personal information in terms of point 6(1)(a)-(e), namely –
  • In the course of a purely personal or household activity;
  • That is anonymised data, namely, data de-identified to the extent that it cannot be re-identified again;
  • By or on behalf of a public body which involves national security or the prevention of unlawful activities to the extent that adequate safeguards have been established in legislation;
  • By the Cabinet or its committees or the executive council of a province; or
  • Relating to the judicial functions of a court.

Exemptions from one or more conditions for the processing of personal information:

• Exemptions granted by the Regulator in terms of section 37.

The Regulator established in terms of the Act may grant an exemption, when satisfied that –

• (a) the public interest in the processing outweighs, to a substantial degree, any interference with the privacy of the data subject, or
• (b) the processing involves a clear benefit to the data subject or a third party that outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing.’
• The ‘public interest’ includes the interests of national security, the importance of crime prevention, the economic and financial interests of a public body, the importance of fostering compliance with legal provisions, historical, statistical or research activity, and the special importance of freedom of expression.

The ‘improper conduct’ exemption in section 38:

Processing of personal information is exempt from certain provisions of the Act when done for the purposes of a ‘relevant function’ of a public body, or for purposes conferred in terms of the law, when the function is performed in order to protect members of the public against financial loss due to improper conduct by, or the unfitness or incompetence of persons authorised to carry on any profession or other activity, or persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate.

The provisions from which exemptions may be granted are –

• the right of a data subject to object to the processing of personal information in subsection 11(3) and (4);
• the general obligation to collect personal information directly from the data subject in section 12;
• the condition that further processing of must be compatible with the purpose of collection of the information in section 15; and
• the right of the data subject to be notified when personal information is collected in section 18.