Restrictions on the collection or processing of the personal data

There are a number of restrictions under the Data Protection and Privacy Act which ought to be complied with in the collection and processing of personal data. These include but are not limited to the following:

• The informed consent of the data subject must be obtained prior to collection or processing of personal data;
• The data subject must be informed of all the recipients of their personal data, including any third parties with whom such data will or may be shared;
• The collection or processing of personal data relating to a child is prohibited unless:
  1. done with the prior consent of the parent / guardian;
  2. necessary for compliance with the law; or
  3. the collection or processing is for research or statistical purposes;
• Special personal data should not be collected or processed unless specifically permitted by the law;
• Personal data should be collected directly from the data subject;
• Personal data shall only be collected for a lawful and specific purpose which relates to the functions or activity of the data collector or data controller;
• A data collector, data processor or data controller is obligated to ensure that the data is complete, accurate, up to-date and not misleading;
• Further processing of personal data shall only be for the specific purpose in connection with which the personal data was collected;
• Personal data shall not be retained for a period longer than is necessary to achieve the purpose for which the data is collected and processed unless specifically authorised by the Act;
• A personal data record should be destroyed or de-identified after the expiry of the retention period in a manner that prevents reconstruction of the personal data in an intelligible form.