PART IV CORRECTION AND PROTECTION OF PERSONAL INFORMATION HELD BY GOVERNMENTAL AND PRIVATE BODIES Application of Part and definition of personal information 49. (1) The provisions of this Part shall apply notwithstanding any other law to the contrary. (2) This Part, except sections 49A, 49B and 49B, shall not apply to material - (a) made or acquired and preserved solely for public reference or exhibition purposes in a library or museum; or (b) material placed in - (i) an archive or accession as defined in section 1 of the Archive Act, 1962 (Act No. 6 of 1962); or (ii) a library or museum [being] controlled by a governmental body[, or a division of a governmental body], by or on behalf of an individual or body other than a governmental body. (3) For the purposes of this Part, except sections 49A, 49B and 49B, personal information shall not include information - (a) about an individual who is or was an official of a governmental body [that] if the information relates to the position or functions of the individual, including - (i) the fact that the individual is or was an official of the governmental body; (ii) the title, work address, work phone number or other similar particulars of the individual; (iii) the classification, salary scale or remuneration and responsibilities of the position held or services performed by the individual; (iv) the name of the individual on a record prepared by the individual in the course of employment; or (b) already publicly available. Right of access to personal information held by private bodies 49A. (1) Where a record containing personal information is held by a private body and a request for access to that record is made by the individual to whom the information relates, the chief executive officer of the private body shall, notwithstanding the provisions of any other law, but subject to this section, give access to the record to that individual as soon as reasonably practicable, but in any event, within 21 days, after the request is received. (2) A request under subsection (1) shall - (a) be made orally or in writing to the chief executive officer of the private body at his or her address, phone or fax number or electronic mail address; and (b) provide sufficient particulars to enable an employee of the private body to identify the record; (c) specify a postal address for the requester in the Republic; and (d) state the capacity in which the requester is making the request and include - (i) the requester's identity document or a certified copy thereof; or (ii) any other proof of the requester's identity to the satisfaction of the chief executive officer of the private body. (3) A request under subsection (1) may be made - (a) by the individual to whom the personal information relates or his or her authorised representative; (b) if the individual referred to in paragraph (a) is - (i) under the age of 16 years, by a person having parental responsibility for the individual; (ii) incapable of managing his or her affairs, by a person appointed by the court to manage those affairs; (iii) deceased, by the personal representative of the individual. (4) If a request under subsection (1) is granted and, upon a request, a copy of the record concerned is provided, the prescribed fee for the cost of making the copy may be charged. (5) The provisions of sections 21, 28, 29, 30, 31, 32(a) and (c), 38, 39, 40(1)(a), 41, 43, 44, 45, 46 and 48 shall apply, with the necessary modifications, to a request under subsection (1). (6) The chief executive officer of a private body may, subject to such conditions as he or she may determine, delegate any of his or her powers under this Part or assign any of his or her duties in terms of this Part to any employee of the private body. Correction of personal information held by private bodies 49B. (1) For the purposes of this section "inaccurate" means incorrect, incomplete, misleading or not relevant to the purpose for which the record is held. (b) A record may be corrected in terms of this section by amending, supplementing or deleting the inaccurate information. (2) Where a record containing personal information held by a private body is inaccurate, the chief executive officer of the private body shall, on the request of the individual to whom the information relates, correct the information as soon as reasonably practicable, but in any event, within 21 days, after the request is received. (3) A request for correction under subsection (2) shall - (a) be made orally or in writing to the chief executive officer of the private body at his or her address, phone or fax number or electronic mail address; and (b) provide sufficient particulars to enable an employee of the private body to identify the record which contains the information that the requester regards as inaccurate; (c) specify the respect in which the requester regards the information as inaccurate; and (d) specify a postal address for the requester in the Republic. (4) The chief executive officer of a private body to whom a request for correction of personal information is made shall, within a reasonable time, decide whether the information identified in the request is inaccurate, and if so, free of charge - (a) correct the information and supply a copy of the part of the record containing the correction to the requester; and (b) determine, so far as possible, whether the inaccurate information is in any other record of the private body and, if it is, make the same correction on the other record. (5) Where the chief executive officer of a private body decides that the information referred to in a request for correction of personal information is accurate, the chief executive officer shall, free of charge - (a) make a note in the record as near as possible to the point where the information appears - (i) of the decision of the chief executive officer that the information was accurate; (ii) that the accuracy of the information is disputed by the requester; and (iii) that the request is attached to the record, and attach the request to the record; and (b) notify the requester - (i) of the decision that the information is accurate; and (ii) that a note was made on the record as described in paragraph (a), and supply a copy of the note to the requester. (6) Where a record containing personal information has been corrected in terms of subsection (4), any disclosure or use of the record after such correction shall be in its corrected form. Correction of personal information held by governmental bodies 49C. (1)(a) For the purposes of this section "inaccurate" means incorrect, incomplete, misleading or not relevant to the purpose for which the record is held. (b) A record may be corrected in terms of this section and section 49B by amending, supplementing or, subject to subsection (6), by deleting the inaccurate information. (2) Where a record containing personal information held by a governmental body is inaccurate, the information officer of the governmental body shall, on the request of the individual to whom the information relates, correct the information. (3) A request for correction shall - (a) be made orally or in writing to the information officer of the governmental body at his or her address, phone or fax number or electronic mail address; (b) provide sufficient particulars to enable an official or employee of the governmental body to identify the record which contains the information that the requester regards as inaccurate; (c) specify the respect in which the requester regards the information as inaccurate; and (d) specify a postal address or fax number for the requester in the Republic. (4) Sections 12, 13, 14, 18 and 19 shall apply, with the necessary modifications, to a request for correction of personal information held by a governmental body. (5) The information officer of a governmental body to whom a request for correction of personal information is made or transferred, shall, subject to sections 18 and 19(1), read with subsection (4) of this section, within 30 days after the request is received or transferred, decide whether the information identified in the request is inaccurate, and if so - (a) correct the information and supply a copy of the part of the record containing the correction to the requester; (b) determine, so far as possible, whether the inaccurate information is in any other record of the governmental body and, if it is, make the same correction on the other record; (c) determine, so far as possible, whether the inaccurate information has been supplied by the governmental body to any other governmental body or person and notify any such governmental body or person of the correction which it has made; and (d) supply to the requester a copy of each notice which it gives in terms of paragraph (c). (6) Where the information officer of a governmental body decides upon a request for correction to delete information contained in a record, he or she shall, before making the deletion - (a) make a copy of the part of the record to be deleted; (b) make a note on that copy of the fact of the deletion to be made in the original record; and (c) retain such copy. (7) A governmental body or a person who has been notified in terms of subsection (5)(c) that such governmental body or person has been supplied with inaccurate information shall, within 30 days after being so notified, correct that information and notify the individual to whom the information relates that the correction has been made. (8) Where the information officer of a governmental body decides that the information referred to in a request for correction of personal information is accurate the information officer shall, free of charge and within 30 days after the request is received or transferred - (a) make a note in the record as near as possible to the point where the information appears - (i) of the decision of the information officer that the information was accurate; (ii) that the accuracy of the information is disputed by the requester; and (iii) that the request is attached to the record, and attach the request to the record; (b) notify the requester - (i) of the decision that the information is accurate; (ii) that a note was made on the record as described in paragraph (a); (iii) that he or she may lodge an internal appeal with the head of the governmental body, or a complaint with the Public Protector, against the decision that the information is accurate, and of the procedure for lodging such an internal appeal and a complaint, and supply a copy of the note to the requester; (c) take such steps as are necessary in the circumstances to enable the requester to provide a statement of any further reasons why he or she considers the information to be inaccurate; and (d) unless the information officer on reasonable grounds considers the statement irrelevant, defamatory or unnecessarily voluminous, attach the statement so provided to the record. (9) Where a record containing personal information has been corrected in terms of subsection (5) or (7), any disclosure or use of the record after such correction shall be in its corrected form. Use of personal information by governmental or private bodies 50. A record of a governmental or private body containing personal information shall not, without the consent of the individual to whom it relates be used except - (a) for the purpose for which the information was obtained or compiled or for a use consistent with that purpose; (b) for a purpose for which the information may be disclosed to a governmental body under section 51(1). Disclosure of personal information by private bodies 50A. A record of a private body containing personal information shall not, without the consent of the individual to whom it relates, be disclosed except - (a) in accordance with a law that authorises its disclosure; or (b) for the purpose of complying with a subpoena, warrant issued or order made by a court, person or body which is authorised to compel the production of information or for the purpose of complying with rules of court relating to the production of information. Disclosure of personal information [held] by governmental bodies 51. (1) A record of a governmental body containing personal information shall not, without the consent of the individual to whom it relates, be disclosed [by a governmental body or an official of the governmental body] except - (a) [in accordance with] as contemplated in section 50A(a) or (b); (b) to an Attorney-General for the purpose of criminal proceedings or to a legal practitioner representing the State, the Government of the Republic, any functionary thereof or a governmental body in civil proceedings for the purpose of those civil proceedings; (c) to any governmental body, on the written request of that body, for the purpose of enforcing any law or carrying out an investigation in terms of any law, if the request specifies the purpose and describes the information to be disclosed; (d) under an agreement between the Government of the Republic or an [institution] organ thereof and the Government of a foreign state, an international organisation or an [institution] organ of any such a government or international organisation, for the purpose of administering or enforcing a law or carrying out an investigation; (e) to an official of any governmental body for the purpose of an internal audit or to the Auditor-General or an official from his or her office for the purpose of audit or to a person appointed to carry out an audit in respect of a governmental body; (f) to the director of archives appointed in terms of section 3 of the Archives Act, 1962 (Act No. 6 of 1962) in accordance with section 6 of that Act; (g) to any person or body for research or statistical purposes if the information officer of the governmental body - (i) is on reasonable grounds satisfied that the purpose for which the information is disclosed cannot [be] reasonably be accomplished unless the information is provided in a form that would identify the individual to whom it relates; and (ii) obtains from the person or body a written undertaking that no subsequent disclosure of the information will be made in a form that could reasonably be expected to identify the individual to whom it relates; (h) to any governmental body for the purpose of locating an individual in order to collect a debt owing to the State, the Government or a governmental body by that individual or to make a payment owing to that individual by the State, the Government or a governmental body; (i) for the purpose of averting an imminent and serious threat to the health or safety of an individual or the public; (j) for any prescribed purpose. (2) Personal information in a record in an archive or accession as defined in section 1 of the Archive Act, 1962 (Act No. 6 of 1962) which has been transferred in accordance with section 6 of that Act by a governmental body for archival or historical purposes may be disclosed in accordance with section 9 of that Act and the regulations made thereunder to any person or body for research or statistical purposes. Record of [undeclared] uses and disclosures not stipulated in manuals to be kept by governmental bodies 52. (1) Where the use or purpose of information in a personal information bank of a governmental body is not included in the statements of uses and purposes set out in accordance with section 5(1)(e)(ii[i])(bb) in a manual published in terms of section 5, the head of a governmental body shall keep a record of any such use by the body of personal information in the personal information bank or any such use or purpose for which such information is disclosed by the governmental body, and attach the record to the personal information. (2) For the purposes of this Act, a record retained in terms of subsection (1) shall be deemed to form part of the personal information to which it is attached. (3) Where the personal information in a personal information bank of a governmental body is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the body but the use is not included in the statement of consistent uses set out in accordance with section 5(1)(e)(iii)(bb) in a manual published in terms of section 5, the head of the body shall ensure that the use is included in the next manual published in terms of section 5. Collection of personal information by governmental bodies 53. (1) No personal information shall be collected by a governmental body unless [it] such collection is - (a) authorised or required by or under any law; or (b) required for the exercise of the functions of the body. (2) A governmental body shall, if possible, collect personal information which is intended to be or may be used in taking any decision which changes an individual's right or determines the content thereof, directly from that individual except where - (a) the individual authorises otherwise; or (b) personal information contained in a record may be disclosed to the body under section 51(1). (3) Where a governmental body collects personal information directly from the individual concerned, the [official] governmental body shall take such steps as are, in the circumstances, reasonable to inform the individual concerned of - (a) the fact that, and the purpose for which, the information is being collected; (b) the name and address of the governmental body that - (i) is collecting the information; and (ii) will hold the information; (c) if the collection of the information is authorised or required by or under law - (i) that particular law; and (ii) whether or not the supply of the information by the individual is voluntary or compulsory; (d) the rights of access to, and correction of, personal information given by this Act. (4) Subsections (2) and (3) do not apply where compliance therewith could reasonably be expected to defeat the purpose, or prejudice the use, for which the information is being collected. Retention, accuracy and disposal of personal information held by governmental bodies 54. (1) Personal information which has been used by a governmental body [for] to make a decision which changes an individual's right, or determines the content thereof, shall be retained by the head of the governmental body for such period after it was so used as may be prescribed in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information. (2) The head of a governmental body shall take all reasonable steps to ensure that personal information which is used [for] to make a decision which changes an individual's right, or determines the content thereof, by the body is as accurate, up-to-date and complete as possible and that - (a) [such information's] the confidentiality of such information is protected; and (b) such information is secured against unauthorised access. (3) The head of a governmental body shall dispose of personal information contained in a record of the governmental body as prescribed. [Compensation for damages] Remedies for disclosure of inaccurate personal information and a contravention of Part 55. (1) It shall be an actionable wrong for a governmental or private body to - (a) use or disclose inaccurate information about an individual; or (b) contravene a provision of this Part, and an individual who suffers harm in consequence of such wrong shall be entitled to such remedies as are appropriate, including an interdict, interim or specific relief, a declaratory order or compensation for harm. (2) For the purposes of subsection (1) - (a) "inaccurate" means incorrect, incomplete, misleading or not relevant to the purpose for which the record is held; (b) "harm" includes loss, detriment, injury, adverse effect on the individual's rights, benefits, privileges or obligations and significant loss of dignity, humiliation or injury to feelings.