(2) Before disclosing any information in terms of subsection (1), the head of a public body shall, if possible,
notify any third party to whom the information relates or directly affects and the Commission.
(3) If it is not reasonably possible to comply with subsection (2), the head of the public body shall mail a notice of disclosure in the prescribed form to the last known address of the third party and to the Commission.
PART V
COLLECTION, P ROTECTION AND R ETENTION OF P ERSONAL INFORMATION BY PUBLIC B ODIES
29 Purposes for which personal information may be collected
A public body may only collect personal information if—
(a) the collection of that information is expressly authorised in terms of an enactment;
(b) the information is to be collected for the purposes of national security, public order and law enforcement; or
(c) the information is to be collected for the purposes of public health; or
(d) the information relates directly to and is necessary for an operating programme, function or activity of
the public body;
(e) the information will be used to formulate public policy.
30 Collection of personal information
(1) A public body shall collect personal information directly from the person to whom it relates unless—
(a) another method of collection is authorised by—
(i) that individual; or
(ii) the Commission; or
(iii) another enactment;
or
(b) the information is to be collected for the purpose of—
(i) determining the suitability for granting an honour or award, including an honorary degree,
scholarship, prize or bursary; or
(ii) proceedings before a court or judicial or quasi-judicial tribunal; or
(iii) collecting a debt or fine or making a payment; or
(iv) law enforcement.
(2) A public body shall inform a person from whom it intends to collect personal information of the purpose
for which the personal information is being collected and the legal authority for collecting it.
(3) Subsection (2) shall not apply if—
(a) the information relates to law enforcement; or
(b) the Commission excuses a public body from complying with the subsection if doing so would result in
the collection of inaccurate information, or defeat the purpose of, or prejudice the use for which, the information is to be collected.
31 Accuracy of personal information
A public body shall, if it intends to use an individual’s personal information to make a decision that will directly affect that individual, take every reasonable step to ensure that the information is accurate and complete.
32 Right to request correction of personal information
(1) Where a person has reason to believe that personal information relating to him that is in the custody or
control of a public body contains an error or omission, he may request the head of that public body to correct such
information.
(2) The head of a public body shall, upon receiving a request in terms of subsection (1), correct or annotate
the personal information on the record pertaining to the person making the request.
(3) The head of a public body shall, when correcting or annotating personal information upon a request made
in terms of subsection (1), notify the correction to any other public body or any third party to whom that information has been disclosed during the last twelve months preceding the request for a correction.
33 Protection of personal information
The head of a public body shall protect personal information that is under his custody or control by taking
reasonable steps to ensure that there is adequate security and there is no unauthorised access, collection, use, disclosure or disposal of such personal information.
34 Retention of personal information
If a public body uses an individual’s personal information to make a decision that directly affects the individual, the public body shall retain that information for at least one year after using it so that the individual has a reasonable opportunity to have access to it.