Processing Personal Information without Consent
As a General Rule…
… Personal Information can only be Processed with the consent of the Data Subject (or a competent person where the Data Subject is as child).
There are however a few limited instances where a Responsible Party will be allowed to Process the Personal Information of a Data Subject without their consent:
– if it is needed in order to conclude or perform a contract with the Data Subject;
– if the Responsible Party is obliged to Process the information to comply with an obligation imposed on it by law;
– if Processing protects a ‘legitimate interest’ of the Data Subject (for example the safety or the prevention of harm);
– if it is necessary to perform a ‘public law duty’ by a public body; or
– if it is necessary for pursuing the ‘legitimate interests’ of the Responsible Party or of a third party that the information has been supplied to.
Important Notes:
Even though the Data Subject’s consent won’t be needed to Process his/her Personal Information in these circumstances, that Personal Information still needs to be Processed in compliance with POPI.
So, POPI will still apply to that Personal Information, only the requirement of consent won’t have to be complied with.