The Data Protection Bill, 2012 (g) the rights of access to, and correction of, personal information provided under this Act. (2) The steps referred to in subsection (1) shall be taken before the information is collected. (3) Where— (a) it is not practicable to comply with subsection (1) before collection of information; or (b) the whereabouts of the data subject are not known, the person collecting information shall, as soon as practicable after the information is collected, comply with subsection (1). (4) An agency shall not be required to take the steps referred to in subsection (1) if the agency has taken those steps on a recent previous occasion when collecting the same information or information of the same kind from that data subject: Provided that the agency shall notify the data subject where information is to be used for a different purpose from the one for which the information was collected previously. (5) An agency shall notify a data subject that a waiver of rights under this Act will be construed as consent and authorisation for collection of information. Collection of personal information. 8. (1) Personal information shall be collected, stored or used by a person— (a) by lawful means; or (b) by means that, in the circumstances, do not intrude to an unreasonable extent, upon the personal affairs of the data subject except in terms of this Act or any other written law. (2) A data controller shall, with respect to personal information kept by him or her, comply with the following limitations— (a) the information is collected for a lawful purpose connected with a function or activity of the agency; and 8