Definition of personal data

The DP Act defines personal data or information as being information about an identifiable individual that is recorded in any form, including:

• Information relating to the race, national or ethnic origin, religion, age or marital status of the individual

• Information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved

• Any identifying number, symbol or other particular assigned to the individual

• The address, fingerprints or blood type of the individual

• The name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual

• Correspondence sent to a data controller by the individual that is explicitly or implicitly of a private or confidential nature, and replies to such correspondence that would reveal the contents of the original correspondence

• The views or opinions of any other person about the individual

Definition of sensitive personal data

The DP Act defines sensitive personal information as any of the following:

• Genetic data, data related to children, data related to offenses, criminal sentences or security measure, biometric data as well as, if they are processed for what they reveal, personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, affiliation, trade-union membership, gender and data concerning health or sex life

• Any personal information otherwise considered by Lesotho law as presenting a major risk to the rights and interests of the data subject, in particular unlawful or arbitrary discrimination.

Section 29 prohibits a data controller from processing sensitive personal information, unless specifically permitted under the DP Act.

Section 36 contains general exemptions to the prohibition on processing sensitive personal information. These include instances where:

• Processing is carried out with prior parental consent where the data subject is a child and is subject to parental control in terms of the law

• The processing is necessary for the establishment, exercise or defense of a right or obligation in law

• Processing is necessary to comply with an obligation of international public law

• The Commission has granted authority in terms of section 37 for processing in the public interest, and appropriate guarantees have been put in place in law to protect the data subject’s privacy

• Processing is carried out with the consent of the data subject

• The information has deliberately been made public by the data subject