prejudice a legitimate interest of the data subject;
(e) the collection of the data from another source is necessary: (i) for
the prevention, detection, investigation, prosecution or
punishment of an offence or breach of law;
(ii) for the enforcement of a law which imposes a pecuniary
penalty;
(iii) for the enforcement of a law which concerns revenue
collection;
(iv) for the conduct of proceedings before any court or tribunal
that have commenced or are reasonably contemplated;
(v) for the protection of national security; or
(vi) for the protection of the interests of a responsible or third
party to whom the information is supplied;
(f) compliance would prejudice a lawful purpose for the
collection; or
(g) compliance is not reasonably practicable.
Collection of data for specific purpose
22. A data controller who collects personal data shall collect the data for a
purpose which is specific, explicitly defined and lawful and is related to the
functions or activity of the person.
Data subject to be made aware of purpose of collection
23. A data controller who collects data shall take the necessary steps to
ensure that the data subject is aware of the purpose for the collection of the
data.
Retention of records
24. (1) Subject to subsections (2) and (3), a data controller who records
personal data shall not retain the personal data for a period longer than is
necessary to achieve the purpose for which the data was collected and processed
unless
(a) the retention of the record is required or authorised by law,
(b) the retention of the record is reasonably necessary for a
lawful purpose related to a function or activity,
(c) retention of the record is required by virtue of a contract between
the parties to the contract, or
(d) the data subject consents to the retention of the record.
(2) Subsection (1) does not apply to records of personal data retained for
(a) historical,
(b) statistical, or
(c) research purposes.