General exemption on sensitive personal information
36
(1) Without prejudice to sections 29 to 35, the prohibition on processing
personal information shall not apply where –
(a) processing is carried out with prior parental consent where the data
subject is a child and is subject to parental control in terms of the
law;
(b) the processing is necessary for the establishment, exercise or
defence of a right or obligation in law;
(c) processing is necessary to comply with an obligation of international
public law;
(d) the Commission has granted authority in terms of section 37 for
processing in the public interest, and appropriate guarantees have
been put in place in law to protect the data subject’s privacy;
(e) processing is carried out with the consent of the data subject; or
(f) the information has deliberately been made public by the data
subject.
Authorisation by the Commission
37
(1) The Commission may authorise a data controller to process personal
information, where the Commission is satisfied that, in the circumstances of
the case (a) the public interest in the processing outweighs, to a substantial
degree, any interference with the privacy of the data subject that
could result from such processing; or