Subject to exceptions provided under the Act, a controller cannot collect personal data unless the collection (a) is for a lawful purpose connected with a function or activity of the data controller, and (b) the collection is necessary for that purpose.

Where the data controller collects personal data directly from the data subject, the data controller shall at the time of collecting personal data ensure that the data subject concerned is informed of:

• The identity and contact details of the controller and, where applicable, its representative and any data protection officer;
• The purpose for which the data are being collected;
• The intended recipients of the data;
• Whether or not the supply of the data by that data subject is voluntary or mandatory;
• The existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• The existence of the right to request from the controller access to and rectification, restriction or erasure of personal data concerning the data subject or to object to the processing;
• The existence of automated decision making, including profiling, and information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
• The period for which the personal data shall be stored;
• The right to lodge a complaint with the Commissioner;
• Where applicable, that the controller intends to transfer personal data to another country and on the level of suitable protection afforded by that country;
• Any further information necessary to guarantee fair processing in respect of the data subject's personal data, having regard to the specific circumstances in which the data are collected.

Where data is not collected directly from the data subject concerned, the data controller or any person acting on his behalf shall ensure that the data subject is informed of the matters set out above.

There are six principles relating to the processing of personal data which are enumerated in the Act. Accordingly, every controller or processor need to ensure that personal data are:

• Processed lawfully, fairly and in a transparent manner in relation to any data subject;
• Collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data are erased or rectified without delay;
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and
• Processed in accordance with the rights of data subjects.

For processing of data to be lawful, it must have a legal basis. One of the legal basis is consent. According to the DPA 2017, no person shall process personal data unless the data subject consents to the processing for one or more specified purposes. Consent is defined under the Act as any freely given, specific, informed and an unambiguous indication of the wishes of a data subject, either by a statement or a clear affirmative action, by which he signifies his agreement to personal data relating to him being processed.

Processing shall also be lawful, when the processing is necessary for any of the following:

• The performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract;
• Compliance with any legal obligation to which the controller is subject;
• In order to protect the vital interests of the data subject or another person;
• The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• The performance of any task carried out by a public authority;
• The exercise, by any person in the public interest, of any other functions of a public nature;
• The legitimate interests pursued by the controller or by a third party to whom the data are disclosed, except if the processing is unwarranted in any particular case having regard to the harm and prejudice to the rights and freedoms or legitimate interests of the data subject;
• The purpose of historical, statistical or scientific research.

Special categories of personal data

Special categories of personal data, as defined above, cannot be processed unless the processing is based on one of the legal basis as described above and the processing is carried out in the course of the controller's / processor's legitimate activities with appropriate safeguards.

It is also possible to process special categories of personal data when:

• Processing relates to personal data which are manifestly made public by the data subject;
• Processing is conducted in the course of its lawful activities by a not-for-profit body with political, philosophical, religious, or trade union aims, ensuring that it applies only to members, former members, or regular contacts, and personal data is not shared externally without the data subjects' consent; or
• Processing is necessary for:
  • the establishment, exercise or defence of a legal claim;
  • the purpose of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services or pursuant to a contract with a health professional subject to the obligation of professional secrecy;
  • the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject; or
  • protecting the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving consent.