The DP Act defines processing as an operation or activity or any set of operations, whether or not by automatic means relating to any of the following:

• The collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation or use

• Dissemination by means of transmission, distribution or making available in any other form

• Merging, linking, as well as blocking, degradation, erasure, or destruction, of information

Under the DP Act (section 15(2)), personal information may only be processed where one of the following applies:

• The data subject provides explicit consent to the processing

• Processing is necessary for the conclusion or performance of a contract to which the data subject is a party

• Processing is necessary for compliance with a legal obligation to which the data controller is subject

• Processing is necessary to protect the legitimate interests of the data subject

• Processing is necessary for the proper performance of public law duty by a public body

• Processing is necessary for pursuing the legitimate interests of the data controller or of a third party to whom the information is supplied

Regarding the collection of data, the DP Act requires that a person shall collect personal information directly from the data subject, except where:

• The information is contained in a public record or has deliberately been made public by the data subject

• The data subject has consented to the collection of the information from another source

• Collection of the information from another source would not prejudice a legitimate interest of the data subject

• Collection of the information from another source is necessary:

• To avoid prejudice to the maintenance or enforcement of the law and order

• For the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated

• In the legitimate interests of national security

• To maintain the legitimate interests of the data controller or of a third party to whom the information is supplied

• Compliance would prejudice a lawful purpose of the collection

• Compliance is not reasonably practicable in the circumstances of the particular case