(15) Protection Authority or Authority: refers to an independent authority established by Part II of this Act. (16) Recipient: is natural or legal person, agency or any other body to whompersonal information is disclosed by a data controller, whether a third party or not; however, persons which receive personal information in the framework of a particular legal inquiry shall not be regarded as recipients. (18) Register: means the register referred to in Part III of this Act. (19) Sensitive data: refers to (a) information or an opinion about an individual which reveals or contains the following (i) racial or ethnic origin; (ii) political opinions; (iii) membership of a political association; (iv) religious beliefs or affiliations; (v) philosophical beliefs; (vi) membership of a professional or trade association; (vii) membership of a trade union; (viii) sex life; (ix) criminal, educational, financial or employment history; (x) gender, age, marital status or family status ; or (b) health information about an individual; (c) genetic information about an individual; or (d) any information which may be considered as presenting a major risk to the rights of the data subject. 3 Scope of Application (20) Third party: refers to any natural or legal person or organization other than the data subject, the controller, the processor and anyone who, under the direct authority of the controller or the processor, is authorized to process the data. (21) Transborder flow: refers to international flows of personal data by the means of transmission including data transmission electronically or by satellite. (22) Whistleblowing: refers to legal provisions permitting individuals to report the behaviour of a member of their organization which, they consider contrary to a law or regulation or fundamental rules established by their organization. (1) This Act shall apply to matters relating to access to information, protection of privacy of information and processing of personal data wholly or partly by automated means; and shall be interpreted as being in addition to and not in substitution for any other law which is not in conflict or inconsistent with this Act. Draft Data Protection Bill Version 1.0 8