The Data Protection Bill, 2018 319 (h) the information is collected pursuant to an authority granted under this Act or any other written law. 13. (1) A data subject shall not be subject to a decision that is based solely on automated processing of personal data which produces legal effect concerning the data subject or which significantly affect the data subject without human intervention. Pi1jbjtjui of 0fflmg. (2) An agency shall not be deemed to have profiled a data subject if the processing of data was necessary to avoid a threat to the maintenance of law and order by any public entity, including the prevention, detection, investigation, prosecution and punishment of a crime. 14. (1) An agency that processes personal data shall ensure that the data is processed - Dataprocessing. without infringing the right to privacy of the data subject or another person; in a lawful manner; and in a reasonable manner. (2) Whenever personal data concerning a data subject is to be processed, the data subject shall have the right, upon request, toinformation relating to the person processing the data; the place of origin of the data; the use to which the data collected will be put to; information relating to any other person to whom the data is to be transmitted; the rectification of incorrect data; and the deletion of processed data without the consent of the data subject. 15. (1) An agency shall take the necessary steps to ensure the integrity of personal data in its possession or control through the adoption of appropriate, reasonable, technical and organisational measures to prevent (a) loss, damage or unauthorised destruction; and Protection and security of personal data.