The knowledge and consent of the individual is required for the collection, use and disclosure of personal information. Collection must be made in accordance with the purpose identified by the organization collecting the personal information.

Sensitive personal information may not be processed except as specifically permitted by law.

The DPA includes provisions that relate specifically to the collection and processing of personal information by public bodies and private enterprises, however, these are not yet in force. Nevertheless, they are presented below.

Public Bodies

Part III of the DPA provides that a public body may collect and process personal data when the following conditions are met: the collection of that information is expressly authorized by law and

• The information is collected for the purpose of law enforcement
• The information relates directly to and is necessary for an operating program or activity of the public body when the collection of personal information is collected directly from the individual:
  • Another method of collection is authorized by the individual, Information Commissioner or law
  • The information is necessary for medical treatment
  • The information is required for determining the suitability of an award
  • The information is collected for judicial proceedings
  • The information is required for the collection of a debt or fine, or
  • It is required for law enforcement purposes
• The individual is informed of the purpose for collecting his / her personal information; the legal authorization for collecting it and contact details of the official or employee of the public body who can answer the individual's questions about the collection

Private Bodies

Part IV of the DPA provides that the collection and processing of personal information by private organizations must be in accordance with certain Codes of Conduct (which are to be determined by the Office of the Information Commissioner in consultation with the private sector) and the General Privacy Principles (which are currently in force).

Sensitive Information

Sensitive personal information may not be processed by public bodies and private organizations without the consent of the individual unless:

• It is necessary for the healthcare of the individual
• The individual has made the information public
• It is for research or statistical analysis
• It is by law enforcement
• It is for the purpose of determining access to social services, or
• As otherwise authorized by law