THE DATA PROTECTION BILL: RIGHTS OF DATA SUBJECTS

Whereas the rights of the data subject are scattered throughout the Data Protection Act, 2018, the proposed Bill has a dedicated portion dealing specifically with the rights of data subjects. These rights align closely with the rights imbued by the GDPR. This week, we unpack Part VIII of the Bill which details the rights of data subjects.

Transparent Information and Communication

The data controller has a duty of transparency to the data subject. Where, for example, a data controller gives a notice to its subjects regarding the processing of their data, the data subject has the right to receive that information in a manner that is easy to understand and access. Such information should be given in writing or by electronic means where appropriate, and at the request of the data subject, orally.

The Right of Access

The data subject has the right to be made aware by the data controller of whether their personal data is being processed, and if so, to be informed of the purpose of processing, the categories of personal data that will be processed and for how long such data will be stored. The data subject must also be made aware of their right to rectification, erasure and restriction of certain data from being processed.

Where a subject’s data is transferred outside the country, or to an international organization, the data subject has the right to be informed of the appropriate safeguards as prescribed by the Bill. We will discuss these safeguards in more detail later in this series.

The Right to Rectification and Erasure

The data subject has the right to have the data controller correct any inaccuracies in their personal data without undue delay. The subject also has the right to complete any incomplete data or provide a supplementary statement.

Additionally, the data subject also enjoys the right to be forgotten, that is, the right to have their data erased or deleted without undue delay under one of the following circumstances:

• The data is no longer necessary for the purpose for which it was obtained;
• The data subject withdraws their consent;
• There is no longer a legitimate reason or legal basis for the controller to still be processing the data;
• The personal data has been unlawfully processed; or
• There is a legal obligation on the data controller to erase the data subject’s personal data.

However, there are exceptions to the application of this right. These include public interest, the exercise of the freedom of expression and information, and the exercise or defense of legal claims.

There are still several other rights under Part VIII of the Bill, join us next week as we look into them as well as the mechanisms available to the data subject to enforce the said rights.

Article by Princess Musa Dube

If you have interest in an in-depth discussion on this subject matter or any Data Protection issues, feel free to contact us at [email protected] Tel: 3116371

Disclaimer: This article is for information purposes only and should not be taken as legal advice.