The Data Protection Bill, 2012
(g) the rights of access to, and correction of, personal
information provided under this Act.
(2) The steps referred to in subsection (1) shall be taken before
the information is collected.
(3) Where—
(a) it is not practicable to comply with subsection (1)
before collection of information; or
(b) the whereabouts of the data subject are not known,
the person collecting information shall, as soon as
practicable after the information is collected, comply
with subsection (1).
(4) An agency shall not be required to take the steps referred
to in subsection (1) if the agency has taken those steps on a recent
previous occasion when collecting the same information or
information of the same kind from that data subject:
Provided that the agency shall notify the data subject where
information is to be used for a different purpose from the one for
which the information was collected previously.
(5) An agency shall notify a data subject that a waiver of
rights under this Act will be construed as consent and authorisation
for collection of information.
Collection of personal
information.
8. (1) Personal information shall be collected, stored or used by a
person—
(a) by lawful means; or
(b) by means that, in the circumstances, do not intrude to
an unreasonable extent, upon the personal affairs of
the data subject except in terms of this Act or any
other written law.
(2) A data controller shall, with respect to personal
information kept by him or her, comply with the following
limitations—
(a) the information is collected for a lawful purpose
connected with a function or activity of the agency;
and
8