white_paper_on_data_protection_in_india_171127_final_v2

South Africa
The POPI Act specifies that personal information must be collected for a specific, explicitly
defined and lawful purpose related to the activity of the collecting party. 496 With respect to
further processing of personal information, it must be compatible with the purposes for which
it was collected. The test for compatibility would take into account factors such as the nature
of the information collected, the consequences of the intended processing to the data subject,
etc. This Act also specifies certain conditions under which further processing of information
will not be considered incompatible. 497
Australia
Under the Privacy Act, consent is not required for the collection of personal information.
However, the collection of personal information must be reasonably connected to the activity
of the collecting entity. The APPs provide that an entity under the Privacy Act can only use
or disclose personal information for a purpose for which it was collected (known as the
primary purpose), or for a secondary purpose if an exception applies. These exceptions
include: (i) where the individual has consented to a secondary use 498 ; (ii) the individual
reasonably expects the entity to use or disclose her personal information for the secondary
purpose, which must be related to the primary purpose 499 ; (iii) if the secondary use/disclosure
is required or authorised by law 500 ; (iv) if there is a permitted general situation which exists in
relation to the secondary use or disclosure, such as permitted situations relating to
enforcement activities. 501
The reasonableness test relies on whether a reasonable person who is properly informed,
would expect such a use of personal data in the circumstances. This is a question of fact in
each individual case and it is the responsibility of the entity to justify its conduct. For
example, an employee of a company would reasonably expect it to use her bank account
information in order to process salary payments. 502 However, she would not reasonably
expect the company to disclose her salary statement to an advertising company.
The OAIC has recognised the incompatibility of purpose limitation and use specification with
current developments in Big Data analytics, a consultation draft published in 2016 suggests
that privacy impact assessments (described in the chapter on notice, above) be carried out to
496 Section 13, POPI Act.
497 Sections 14 and 15, POPI Act.
498 APP 6.1(a), Privacy Act.
499 APP 6.2 (a), Privacy Act.
500 APP 6.2(b), Privacy Act.
501 APPs 6.2(e) and 6.3, Privacy Act.
502 OAIC, ‗Chapter 6: Australian Privacy Principle 6 — Use or disclosure of personal information‘ (February
2014), available at: https://www.oaic.gov.au/resources/agencies-and-organisations/app-guidelines/chapter-6-
app-guidelines-v1.pdf, (last accessed 23 October 2017).
108