Personal Data Protection and Safeguarding Draft Act June 2019 (b) Everyone shall have the right to privacy in the conduct of his private affairs, in his home, among his family, with regard to his property and his relationships. It is not permitted to spy on him, to place him under surveillance or to besmirch his good name. The State shall protect him from arbitrary interference. 1. Data Protection The right to data protection is closely related to the right to privacy. It regulates the way in which information about individuals is collected, processed, stored and retained electronically by both public and private bodies. It has been recognised as both part of international law on privacy and has its own identity being acknowledged as autonomous right. The UN Human Rights Committee has found that data protection is a fundamental part of privacy as protected by Article 17 of the ICCPR. The Committee in General Comment 16 stated that: The gathering and holding of personal information on computers, databanks and other devices, whether by public authorities or private individuals or bodies, must be regulated by law. Effective measures have to be taken by States to ensure that information concerning a person's private life does not reach the hands of persons who are not authorised by law to receive, process and use it, and is never used for purposes incompatible with the Covenant. In order to have the most effective protection of his private life, every individual should have the right to ascertain in an intelligible form, whether, and if so, what personal data is stored in automatic data files, and for what purposes. Every individual should also be able to ascertain which public authorities or private individuals or bodies control or may control their files. If such files contain incorrect personal data or have been collected or processed contrary to the provisions of the law, every individual should have the right to request rectification or elimination.8 Under international law, a number of basic principles have emerged: ● Information about persons should not be collected or processed in unfair and unlawful ways (principle of lawfulness and fairness). This includes obtaining information in an illegal manner such as illegal interceptions, unlawful access to databases and impersonations. ● Those responsible for the collection and processing must ensure it is accurate and, where necessary, kept up-todate (to avoid error of omissions); every reasonable step must be taken to ensure that personal data which is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay (principle of accuracy). ● Personal data shall be collected to serve a specific and legitimate purpose and shall be brought to the knowledge of the data subject (principle of purpose specification). Following application of this principle, data controllers and processors shall ensure that all personal data collected and recorded remain relevant and adequate to the purpose specified and are not used and disclosed for purposes incompatible with those specified and the period for which they are collected does not exceed that which would enable the achievement of the purposes so specified. ● Every data subject has the right to know whether information concerning him/her is being processed and to obtain it in an intelligible form, without undue delay or expense, and to have appropriate rectifications (principle of interestedperson access). ● The prohibition of the collection of data that gives rise to unlawful and arbitrary discrimination, including information about racial or ethnic origin, colour, sex life, political opinions, religious, philosophical and other beliefs as well as membership of an association or trade union. UN Human Rights Committee, General Comment No. 16: The right to respect of privacy, family, home and correspondence, and protection of honour and reputation (Art. 17) : 04/08/1988. 8 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 8 of 58