Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998 38 No. 37067 GOVERNMENT GAZETTE, 26 November 2013 Act No. 4 of 2013 Protection of Personal Information Act, 2013 38 (d) where agreement cannot be reached between the responsible party and the data subject, and if the data subject so requests, take such steps as are reasonable in the circumstances, to attach to the information in such a manner that it will always be read with the information, an indication that a correction of the information has been requested but has not been made. 5 (3) If the responsible party has taken steps under subsection (2) that result in a change to the information and the changed information has an impact on decisions that have been or will be taken in respect of the data subject in question, the responsible party must, if reasonably practicable, inform each person or body or responsible party to whom the personal information has been disclosed of those steps. 10 (4) The responsible party must notify a data subject, who has made a request in terms of subsection (1), of the action taken as a result of the request. Manner of access 25. The provisions of sections 18 and 53 of the Promotion of Access to Information Act apply to requests made in terms of section 23 of this Act. 15 Part B Processing of special personal information Prohibition on processing of special personal information 26. A responsible party may, subject to section 27, not process personal information concerning— 20 (a) the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or (b) the criminal behaviour of a data subject to the extent that such information relates to— 25 (i) the alleged commission by a data subject of any offence; or (ii) any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings. General authorisation concerning special personal information 27. (1) The prohibition on processing personal information, as referred to in section 26, does not apply if the— (a) processing is carried out with the consent of a data subject referred to in section 26; (b) processing is necessary for the establishment, exercise or defence of a right or obligation in law; (c) processing is necessary to comply with an obligation of international public law; (d) processing is for historical, statistical or research purposes to the extent that— (i) the purpose serves a public interest and the processing is necessary for the purpose concerned; or (ii) it appears to be impossible or would involve a disproportionate effort to ask for consent, and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the data subject to a disproportionate extent; (e) information has deliberately been made public by the data subject; or (f) provisions of sections 28 to 33 are, as the case may be, complied with. (2) The Regulator may, subject to subsection (3), upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process special 30 35 40 45