Section 2: Interpretation

2. Interpretation In this Act – “authorised officer” means an officer to whom the Commissioner has delegated his powers under section 13; “biometric data” means any personal data relating to the physical, physiological or behavioural characteristics of an individual which allow his unique identification, including facial images or dactyloscopic data; “collect” does not include receive unsolicited information; “Commissioner” means the Data Protection Commissioner referred to in section 4; “consent” means any freely given specific, informed and unambiguous indication of the wishes of a data subject, either by a statement or a clear affirmative action, by which he signifies his agreement to personal data relating to him being processed; “controller” means a person who or public body which, alone or jointly with others, determines the purposes and means of the processing of personal data and has decision making power with respect to the processing; 472 Acts 2017 Acts 2017 473 “data subject” means an identified or identifiable individual, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual; “document” includes – (a) a disc, tape or other device in which information other than visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the disc, tape or other device; and (b) a film, tape or other device in which visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the film, tape or other device; “encryption” means the process of transforming data into coded form; “filing system” means a structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis; “genetic data” means personal data relating to the general characteristics of an individual which are inherited or acquired and which provide unique information about the physiology or health of the individual and which result, in particular, from an analysis of a biological sample from the individual in question; “physical or mental health”, in relation to personal data, includes information on the provision of health care services to the individual, which reveals his health status; “individual” means a living individual; “information and communication network” – (a) means a network for the transmission of messages; and (b) includes a telecommunication network; 472 Acts 2017 Acts 2017 473 “Minister” means the Minister to whom responsibility for the subject of data protection is assigned; “network” means a communication transmission system that provides interconnection among a number of local and remote devices; “Office” means the Data Protection Office referred to in section 4; “personal data” means any information relating to a data subject; “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; “proceedings” – (a) means any proceedings conducted by or under the supervision of a Judge or Magistrate; and (b) may include – (i) an inquiry or investigation into an offence; and (ii) disciplinary pro n section 4; “personal data” means any information relating to a data subject; “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; “proceedings” – (a) means any proceedings conducted by or under the supervision of a Judge or Magistrate; and (b) may include – (i) an inquiry or investigation into an offence; and (ii) disciplinary proceedings; “processor” means a person who, or public body which, processes personal data on behalf of a controller; “processing” means an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; “profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; 474 Acts 2017 Acts 2017 475 “pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information and the additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable individual; “recipient” means a person to whom, or a public body to which, personal data are disclosed, whether a third party or not; “register” means the register referred to in section 20; “registration certificate” means the registration certificate referred to in section 16 (2); “restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future; “special categories of personal data”, in relation to a data subject, means personal data pertaining to – (a) his racial or ethnic origin; (b) his political opinion or adherence; (c) his religious or philosophical beliefs; (d) his membership of a trade union; (e) his physical or mental health or condition; (f) his sexual orientation, practices or preferences; (g) his genetic data or biometric data uniquely identifying him; (h) the commission or alleged commission of an offence by him; (i) any proceedings for an offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any Court in the proceedings; or (j) such other personal data as the Commissioner may determine to be sensitive personal data; 474 Acts 2017 Acts 2017 475 “telecommunication network” means a system, or a series of systems, operating within such boundaries as may be prescribed, for the transmission or reception of messages by means of guided or unguided electro magnetic energy or both; “third party” means a person or public body other than a data subject, a controller, a processor or a person who, under the direct authority of a controller or processor, who or which is authorised to process personal data; “traffic data” means any data relating to a com ecommunication network” means a system, or a series of systems, operating within such boundaries as may be prescribed, for the transmission or reception of messages by means of guided or unguided electro magnetic energy or both; “third party” means a person or public body other than a data subject, a controller, a processor or a person who, under the direct authority of a controller or processor, who or which is authorised to process personal data; “traffic data” means any data relating to a communication by means of a computer system and generated by the system that form part in the chain of communication, indicating the communication’s origin, destination, route, time, date, size, duration, or type of underlying service; “Tribunal” means the ICT Appeal Tribunal set up under section 35 of the Information and Communication Technologies Act.