“automated individual decision-making and profiling” means a decision based solely on automated processing, including profiling and shall only be carried out under PART II Section 11 of this Act; “biometric data” means personal data relating to the physical, physiological, biological or behavioural characteristics of an individual which allows the unique identification or authentication of the individual including by facial images or dactyloscopic data; “child”, refers to a person who is under the legal age of majority in accordance with the law of Namibia; “consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, either by a statement or by clear affirmative action, signifies his or her agreement to the specified processing of personal data relating to him or her; “controller” means a natural or legal person or public body that alone or jointly with others (‘joint-controllers’), has decision-making powers determining the purposes and means of the processing of personal data. Where the purposes and means of processing are determined by an act, decree or ordinance, the controller is a natural person, legal person or public body that has been designated as such by that act, decree or ordinance. The controller shall be responsible for the processing of personal data carried out on its behalf by a processor; “data concerning health” means personal data that are related to the past, present or future physical or mental health of an individual, and which includes information relating to the provision of health care services which reveal information about the individual’s health status; “Data Protection Supervisory Authority or Supervisory Authority”, refers to an independent public authority responsible for ensuring that personal data is processed in compliance with the provisions of this Act. This implies a decision-making power independent of any direct or indirect external influence on that Authority; “data subject” means an identified or identifiable living individual to whom personal data relates. An “identified or Identifiable individual” means: (a) a person who can be identified, directly or indirectly, in particular by reference to an identification number or one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity. (b) To determine whether a person is identifiable, account should be taken of all the means reasonably likely to be used either by the controller or by any other person to identify the said person. (c) An individual is “identifiable” if the processing allows the individual to be ‘singled out’ from other individuals. “direct marketing” means the communication of any advertising or marketing material which is directed to any particular individual; 3