Purpose
3. The purpose of this Act is to govern the collection, use and disclosure of personal data by organisations in a manner that recognises both the right of individuals to protect their personal data and the need of organisations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances.
Application of Act
4.—(1) Parts III to VI shall not impose any obligation on—
- (a) any individual acting in a personal or domestic capacity;
- (b) any employee acting in the course of his employment with an organisation;
- (c) any public agency or an organisation in the course of acting on behalf of a public agency in relation to the collection, use or disclosure of the personal data; or
- (d) any other organisations or personal data, or classes of organisations or personal data, prescribed for the purposes of this provision.
(2) Parts III to VI (except for section 24 (protection of personal data) and section 25 (retention of personal data)) shall not impose any obligation on a data intermediary in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing.
(3) An organisation shall have the same obligation under this Act in respect of personal data processed on its behalf and for its purposes by a data intermediary as if the personal data were processed by the organisation itself.
(4) This Act shall not apply in respect of—
- (a) personal data about an individual that is contained in a record that has been in existence for at least 100 years; or
- (b) personal data about a deceased individual, except that the provisions relating to the disclosure of personal data and section 24 (protection of personal data) shall apply in respect
