27
The purposes for which personal data are collected should be specified
not later than at the time of data collection and the subsequent use
limited to the fulfilment of those purposes or such others as are not
incompatible with those purposes and as are specified on each occasion
of change of purpose.
7.Individual Participation Principles
An individual should have the right:
(a) to obtain from a data controller, or otherwise, confirmation of
whether or not the data controller has data relating to him;
(b) to have communicated to him, data relating to him (i)within a
reasonable time; (ii)at a charge, if any, that is not excessive; (iii)in a
reasonable manner; and (iv) in a form that is readily intelligible to
him;
(c) to be given reasons if a request is made under subparagraph (a) and
(b) is denied, and to be able to challenge such denial; and
(d) to challenge data relating to him and, if the challenge is successful,
to have the data erased, rectified, completed or amended.
8.Accountability Principle
A data controller should be accountable for complying with measures
that give effect to the principles stated above.
In addition to the eight privacy principles, the Guidelines set out
principles for free flow of data and legitimate restrictions, national
implementation and international co-operation.
4.3.4 These eight principles are generally agreed to deal with the most
important issues regarding the protection of personal privacy in an
electronically connected world. More importantly for Botswana and
other jurisdictions wishing to do business globally through electronic
media, they are reflected in the European Community Parliament and
Council Directive on the Protection of Individuals with Regard to the
Processing of Personal Data and on the Free Movement of Such Data.15
Noting that data processing systems are intended to be servants and must
respect fundamental rights of individuals, including privacy, the
Directive sets out Principles Relating to Data Quality.
4.3.5
15
Article 6 indicates that Member States [through their national
legislation] must provide that personal data must be:
•
Processed fairly and lawfully;
Directive95/46EC, October 24, 1995, Official Journal L 281, 23/11/1995 P. 0031-0050.