Characteristics for processing publicly available personal data

This is not addressed by the Act or the Regulations.

Characteristics for processing sensitive personal data

According to section 11 of the Act, written consent from the data subject is required to process sensitive data. This consent can be withdrawn at any time without explanation and free of charge.

The Minister responsible for the Cyber Security and Monitoring Centre may give directions on processing sensitive data related to national security or state interests.

Several exceptions to the written consent requirement are outlined in the Act, including:

• Processing necessary to carry out the controller's obligations and rights in employment law;
• Processing necessary to protect the vital interests of the data subject or another person when the data subject is incapable of giving consent;
• Processing carried out by a foundation, association, or other non-profit for political, philosophical, religious, health-insurance, or trade-union purposes, provided the processing relates only to members or those with regular contact and the data is not disclosed to third parties without consent;
• Processing necessary to comply with national security laws;
• Processing necessary for the establishment, exercise, or defence of legal claims;
• Processing of data made public by the data subject;
• Processing necessary for scientific research, with conditions specified by the Authority;
• Processing authorized by law for reasons of substantial public interest.

Characteristics for processing personal data of persons with incapacity or limited capacity and minors under the age of 16

The processing of children’s data is subject to the provisions of section 26 of the Act, which addresses the representation of data subjects who are children. Characteristics for processing personal data of persons with incapacity or limited capacity and minors under the age of 16.

Where the data subject is a child, their rights may be exercised by their parents or legal guardian.

Data subjects who are physically, mentally, or legally incapable of exercising their rights may exercise them through a parent, guardian, or as provided by law or a court.

When processing children's information, data controllers must:

• Obtain consent from the child's parent or legal guardian;
• Make reasonable efforts to verify that consent is given or authorized by the parent or legal guardian;
• Adhere to all data processing principles;
• Conduct regular data protection impact assessments to identify and mitigate privacy risks to children;
• Ensure data protection by design and data protection by default;
• Avoid subjecting children’s data to automated decision making that affects their rights.

Characteristics for processing biometric personal data

According to section 12 of the Act, Processing genetic, biometric, and health data is prohibited unless the data subject gives written consent.

The written consent requirement for genetic, biometric, and health data can be withdrawn at any time without explanation and free of charge.

Several exceptions to the written consent requirement for genetic, biometric, and health data are outlined in the Act, including:

• Processing necessary to carry out the controller's obligations and rights in employment law;
• Processing necessary to comply with national security laws;
• Processing necessary for the promotion and protection of public health;
• Processing required by law for reasons of substantial public interest;
• Processing necessary to protect the vital interests of the data subject or another person when the data subject is incapable of giving consent;
• Processing necessary for the prevention of imminent danger or the mitigation of a criminal offense;
• Processing of data made public by the data subject;
• Processing necessary for the establishment, exercise, or defence of legal rights;
• Processing required for scientific research;
• Processing necessary for preventative medicine, medical diagnosis, the provision of care or treatment, or the management of healthcare services;
• Health-related data may only be processed under the responsibility of a healthcare professional unless the data subject provides written consent or the processing is necessary for the prevention of imminent danger or the mitigation of a criminal offense.

Processing of personal data by an authorized person assigned by the processor of data

According to section 17 of the Act, only persons acting under the authority of the controller, as well as the processor themselves may process data as instructed by the controller. 

Blocking or destruction of personal data

This is not addressed by the Act or the Regulations.