Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998 44 No. 37067 GOVERNMENT GAZETTE, 26 November 2013 Act No. 4 of 2013 Protection of Personal Information Act, 2013 44 of personal information concerning a data subject’s health, as referred to under subsection (1)(a), with a view to the proper treatment or care of the data subject. (5) Personal information concerning inherited characteristics may not be processed in respect of a data subject from whom the information concerned has been obtained, unless— (a) a serious medical interest prevails; or (b) the processing is necessary for historical, statistical or research activity. (6) More detailed rules may be prescribed concerning the application of subsection (1)(b) and (f). 5 Authorisation concerning data subject’s criminal behaviour or biometric informa- 10 tion 33. (1) The prohibition on processing personal information concerning a data subject’s criminal behaviour or biometric information, as referred to in section 26, does not apply if the processing is carried out by bodies charged by law with applying criminal law or by responsible parties who have obtained that information in accordance 15 with the law. (2) The processing of information concerning personnel in the service of the responsible party must take place in accordance with the rules established in compliance with labour legislation. (3) The prohibition on processing any of the categories of personal information 20 referred to in section 26 does not apply if such processing is necessary to supplement the processing of information on criminal behaviour or biometric information permitted by this section. Part C Processing of personal information of children 25 Prohibition on processing personal information of children 34. A responsible party may, subject to section 35, not process personal information concerning a child. General authorisation concerning personal information of children 35. (1) The prohibition on processing personal information of children, as referred to in section 34, does not apply if the processing is— (a) carried out with the prior consent of a competent person; (b) necessary for the establishment, exercise or defence of a right or obligation in law; (c) necessary to comply with an obligation of international public law; (d) for historical, statistical or research purposes to the extent that— (i) the purpose serves a public interest and the processing is necessary for the purpose concerned; or (ii) it appears to be impossible or would involve a disproportionate effort to ask for consent, and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the child to a disproportionate extent; or (e) of personal information which has deliberately been made public by the child with the consent of a competent person. (2) The Regulator may, notwithstanding the prohibition referred to in section 34, but subject to subsection (3), upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process the personal information of children if the processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the child. (3) The Regulator may impose reasonable conditions in respect of any authorisation granted under subsection (2), including conditions with regard to how a responsible party must— 30 35 40 45 50