In aspiring to acquire the capacity to protect privacy rights a marketer has to first identify privacy expectations of a consumer in any given circumstance and interpret applicable laws or principles . It can be surmised that a consumer ’ s least privacy expectation is in the law as the two are intertwined .
from the consumer unless authorized to do so or where she has intentionally made the personal data public .
Consumers should be informed whether their data will be shared with third parties and of their right to withdraw consent . Marketers must respond to any consumer rights requests .
Data processing must be lawful , for instance , it cannot be based on sensitive personal data . As aforementioned sensitive personal data is any information on a data subject ’ s race , health status , ethnic social origin , genetic data , biometric data , sex or sexual orientation of the consumer , spouse or spouses , marital status , a person ’ s children or parents or any family data .
Section 45 permits processing of sensitive personal data in limited circumstances if the consumer permits it or is done in the course of legitimate activities by a foundation or a not-for-profit organization , religious or trade union or in the defense of a legal claim .
Data on health may only be processed by a health care provider or under professional secrecy .
The fairness principle aims at preventing an unfair imbalance in the relationship between a marketer and consumer . Power imbalance can be a situation that affords a consumer a higher risk of suffering from adverse effects while the marketer has the informational dominance or institutional hierarchy .
( 2 ). Personal data must be collected for specific and legitimate purposes only .
The data requested should be sufficient to fulfill the purpose and not excessive . A rational link between the data and objective ought to be established .
( 3 ). Explanation required from the marketer to the consumer where information requested concerns family or private affairs .
The Act provides that data subjects must be given reasons as to why their private affairs need to be disclosed by them before collection of such data by a marketer and request for the consumer ’ s consent for the collection .
( 4 ). To keep accurate and up-to-date data
A marketer has the duty to notify consumers that they have the right to correct any
“
In aspiring to acquire the capacity to protect privacy rights a marketer has to first identify privacy expectations of a consumer in any given circumstance and interpret applicable laws or principles . It can be surmised that a consumer ’ s least privacy expectation is in the law as the two are intertwined .
information stored by the marketer that is misleading or false and request for deletion .
( 5 ). To keep personal data in a form which identifies the consumer for no longer than is necessary and only for the purpose for which it was collected .
( 6 ). To not transfer data without proof of adequate safeguards or consent from the data subject .
Anonymization of data is one of the ways that data can be kept in an appropriate form especially where it is foreseen that the marketer intends to keep the data for a long time as authorized by a consumer . Anonymization is the removal of personal identifiers from personal data so that the consumer ’ s information is no longer identifiable . Section 37 ( 2 ) of the Act provides that where the personal data collected is for commercial purposes it shall where possible anonymize the data so as to no longer have the data identifiable .
Encryption may also be used in keeping personal data in an appropriate form that fits the use . It is the process of converting the content of any readable data using technical means into coded form .
Pseudonymization is where personal data is processed in such a manner that it can no longer be attributed to a specific data without the use of additional information and such additional information is kept separately and is subject to technical and organizational measures .
Data Protection Impact Assessment
Marketers are obligated to assess any intended processing of data with the aim of establishing whether the risk involved in the exercise might compromise consumers ’ rights to privacy . The nature , magnitude and purpose of an intended operation should inform a marketer whether an impact assessment is necessary .
By law as stated at Section 31 of the Act , the data protection impact assessment involves a systematic description of the intended processing operation , the necessity and proportionality , the risks attached to the process and the security measures and mechanisms proposed to mitigate identified risks .
If the assessment report discloses a high risk to consumers ’ rights and freedoms the marketer is obligated to consult the Data Commissioner or simply stop the processing if there are no available specific mitigation measures . The Data Commissioner must receive the data impact assessment report within sixty days prior to processing of data by the marketer .
In essence , what should a marketer do to comply with consumer privacy expectation and data protection laws ?
( a ). Minimize processing of personal data and pseudonymize where and as soon as possible .
( b ). Be transparent in the processing of personal data .
( c ). Formulate and implement policies , structures , processes and measures both technical and organizational that include staff training that adhere to data protection principles and achieve reasonable and acceptable security features but tailor them to your circumstances , gradually .
Ray Mududa Tollo is the Managing Partner at Omulele & Tollo Advocates . You can commune with him on this or related matters via mail at : Tollo @ ot-advocates . com .