Electronic Communications and Transactions Act - South Africa ...

48 No. 23708 GOVERNMENT GAZETIE, 2 AUGUST 2002Act No. 25,2002 ELECTRONIC COMMUNICATIONS ANDTRANSACTIONS ACT, 2002for the collection, collation, processing or disclosure of any personal information on thatdata subject unless he or she is permitted or required to do so by law.(2) A data controller may not electronically request, collect, collate, process or storepersonal information on a data subject which is not necessary for the lawful purpose forwhich the personal information is required.(3) The data controller must disclose in writing to the data subject the specific purposefor which any personal information is being requested, collected, collated, processed orstored.(4) The data controller may not use the personal information for any other purposethan the disclosed purpose without the express written permission of the data subject,unless he or she is permitted or required to do so by law.(5) The data controller must, for as long as the personal information is used and for aperiod of at least one year thereafter, keep a record of the personal information and thespecific purpose for which the personal information was collected.(6) A data controller may not disclose any of the personal information held by it to athird party. unless required or permitted by law or specifically authorised to do so inwriting by the data subject.(7) The data controller must. for as long as the personal information is used and for aperiod ofat least one year thereafter, keep a record of any third party to whom thepersonal information was disclosed and of the date on which and the purpose for whichit was disclosed.(8) The data controller must delete or destroy all personal information which hasbecome obsolete.(9) A party controlling personal information may use that personal information tocompile profiles for statistical purposes and may freely trade with such profiles andstatistical data. as long as the profiles or statistical data cannot be linked to any specificdata subject by a third party.510152025CHAPTER IXPROTECTION OF CRITICAL DATABASESScope of critical database protection3052. The provisions of this Chapter only apply to a critical database administrator andcritical databases or parts thereof.Identification of critical data and critical databases53. The Minister may by notice in the Guzerre-(a) declare certain classes of information which is of importance to the protectionof the national security of the Republic or the economic and social well-beingof its citizens to be critical data for the purposes of this Chapter; and([I) establish procedures to be followed in the identification of critical databasesfor the purposes of this Chapter.Registration of critical databases354054. (1) The Minister may by notice in the Gazerto determine-(a) requirements for the registration of critical databases with the Department orsuch other body as the Minister may specify;(bj procedures to be followed for registration: and(cJ any other matter relating to registration. 45(3) For purposes of this Chapter, registration of a critical database means recordingthe following information in a register maintained by the Department or by such otherbody as the Minister may specify:(a) The full name, address and contact details of the critical database administrator;50(12) the location of the critical database, including the locations of componentparts thereof where a critical database is not stored at a single location; and