Data Protection Act (Part II - Data Protection Commission)

LESOTHO

Government Gazette

Vol. 57

Wednesday - 22nd February, 2012

No. 19

CONTENTS

No.

Page

ACT

5 Data Protection Act, 2011 .247

GOVERNMENT NOTICE

10 Statement of Objects and Reasons of the .290 Data Protection Act, 2011

OTHER NOTICES

(See Supplement of the Gazette)

Published by the Authority of His Majesty the King

Price: M37.00

ACT NO. 5 OF 2012

Data Protection Act, 2011

Arrangement of Sections

Sections

PART I PRELIMINARY

1. Citation and commencement
2. Interpretation
3. Application of the Act
4. Exemptions
5. Sector specific legislation

PART II - DATA PROTECTION COMMISSION

1. Establishment of the Data Protection Commission
2. Disqualification from office
3. Functions of the Commission
4. Tenure of office
5. Allowances of the members of the Commission
6. Funds of the Commission
7. Audit of accounts
8. Protection of Commission
9. Duty of confidentiality

PART III PROTECTION OF PERSONAL INFORMATION

1. Processing of personal information
2. Minimality
3. Collection directly from the data subject
4. Purpose specification and further processing limitation
5. Retention of records
6. Security measures on integrity of personal information

Information processed by an agent of the data controller Security measures regarding information processed by an agent 2. Notification of security compromises 24. Quality of Information

1. Notification to the Commission and to the data subject
2. Access to and challenges of personal information

2.7. Correction of personal information 28. Data controller to give effect to principles 29. Prohibition on processing of sensitive personal information

PART IV EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL INFORMATION

1. Exemption on data subject's spiritual, religious or philosophical beliefs
2. Exemption on data subject's race
3. Exemption on data subject’s trade union membership
4. Exemption on data subject’s political affiliation
5. Exemption on data subject's health or sexual life
6. Exemption on data subject’s criminal behaviour
7. General exemption on sensitive personal information
8. Authorisation by the Commission
9. Exemption for processing of personal data for historical, statistical and research purposes

PART V ENFORCEMENT

1. Complaints
2. Investigation by the Commission
3. No action by the Commission
4. Pre-investigations by the Commission
5. Investigation proceedings of the Commission
6. Matters exempt from search and seizure
7. Parties to be informed of developments during and result of investigation
8. Enforcement notice
9. Cancellation of an enforcement notice
10. Reviews and appeals
11. Civil remedies

PART VI GENERAL PROVISIONS

1. Unsolicited electronic communications
2. Automated decision making
3. Transfer of personal information outside Lesotho

1. Notifications
2. Codes of conduct
3. Offences and penalties
4. Regulations
5. Transitional arrangements

ACT NO. 5 OF 2012

Data Protection Act, 2011

An Act to establish the Data Protection Commission, provide for principles for regulation of processing of personal information in order to protect and reconcile the fundamental and competing values of personal information privacy under this Act and sector-specific legislation and other related matters.

Enacted by the Parliament of Lesotho.

PART I - PRELIMINARY

Citation and commencement