THE DATA PROTECTION BILL: PROCESSING OF SENSITIVE PERSONAL DATA

Generally speaking, it is prohibited to process sensitive personal data. Sensitive personal data is data which reveals someone’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic or biometric data for the purpose of uniquely identifying a natural person, as well as data concerning someone’s health or sex life or sexual orientation.

There are, however, a few exceptions to this general rule, and these include, consent, necessity, vital interest, contractual obligations, public interest, public health, to assist in the prevention of a crime etc.

Where public interest is the legal basis for processing sensitive personal data, the public interest must be substantial and based on a law which is proportionate for the aim sought to be achieved. For example, the Ministry of Health investigating the general trends in the outbreak of a certain disease, would not necessarily need to process data on people’s religious or political views. Furthermore, the law relied on must provide measures to safeguard the fundamental rights of the data subject.

Where data is processed for purposes of protection against serious cross-border threats to health, such as what we experienced during the COVID-19 pandemic, data ought to be processed by a professional. The said professional must uphold the obligation of professional secrecy such as doctor-patient confidentiality in the health sector and attorney-client privilege in the legal realm. Under all circumstances, the rights of the data subject must be respected.

Personal data relating to criminal convictions and offenses shall not be processed unless the data controller is subject to a law which provides appropriate safeguards for the rights and freedoms of the data subject.

It is quite evident that the proposed Data Protection Bill has, as its main concern, the protection of the rights of the data subject. However, at any time, the data subject is at liberty to give consent to the processing of their data. Towards the end of this series, we shall analyze the potential problem with consent and how it may well defeat the ends of the proposed Bill.

In the meantime, join us next week as we unpack Part VIII of the Bill which speaks to the Rights of Data Subjects.

Article by Princess Musa Dube

If you have interest in an in-depth discussion on this subject matter or any Data Protection related issues, feel free to contact us at [email protected] Tel: 3116371

Disclaimer: This article is for information purposes only and should not be taken as legal advice.