v. in the interests of national security;
(d) compliance would prejudice a lawful purpose of the collection;
(e) compliance is not reasonably practicable in the circumstances of the
particular case; or
(f) the information shall –
i. not be used in a form in which the data subject may be
identified; or
ii. be used for historical, statistical or research purposes.
(5) A data controller shall process personal information only upon notification to
the commission.
Access to and challenges of personal information
26.
(1) A data subject who provides adequate proof of identity, shall have a right to
request (a) A data controller to confirm, free of charge, whether or not the data
controller holds personal information about the data subject; and
(b) from a data controller, personal information about the data subject
held by the data controller, including information about the identity
of all third parties who have or have had, access to the information –
i. within a prescribed time;
ii. at a prescribed fee;
iii. in a reasonable manner and format; and
iv. in a form that is generally understandable.
(2) Where the data controller denies a data subject a request made in terms of
subsection (1) above, the data subject shall be entitled to be iven written
reasons for the denial.