both, or other device, and any material subsequently derived from information so-produced, recorded or stored; (iii) label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means; (iv) book, map, plan, graph or drawing; or (v) photograph, film, negative, tape, or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced; (b) in the possession or under the control of a data controller; (c) whether or not it was created by the data controller; and (d) regardless of when it came into existence; “re-identify” in relation to personal information of a data subject, means to resurrect any information that has been de-identified, that – (a) identifies the data subject; (b) can be used or manipulated by a reasonably foreseeable method to identify the data subject; or (c) can be linked by a reasonably foreseeable method to other information that identifies the data subject. “sensitive personal information” (a) refers to genetic data, data related to children, data related to offences, criminal sentences or security measure, biometric data as well as, if they are processed for what they reveal, personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, affiliation, trade-union membership, gender and data concerning health or sex life (b) refers also to any personal information otherwise considered by Lesotho law as presenting a major risk to the rights and interests of the data subject, in particular