Creative Entrepreneurs need to know about the Data Protection Act

June 1, 2024 marks the end of the a six (6) months grace period for data controllers to pay the prescribed fee and register the registration particulars with the Commissioner pursuant to the Data Protection Act ("the Act"), 2020. The Act was enacted for the purposes of establishing data protection standards which are intended to safeguard the processing of personal information. Data controllers are identified in the Act as entities or individuals who handle personal information in their day-to-day operations.

This applies to Creative Entrepreneurs, a term coined to describe companies and businesses within the creative or entertainment industry that provide goods and services to customers/clients. Therefore, Creative Entrepreneurs, ranging from recording studios to nail technicians to advertising agencies, and anyone else who processes personal data are categorised as data controllers under the Act.

WHAT DOES THIS LOOK LIKE FOR CREATIVE ENTREPRENEURS

Example 1: A hair or nail technician, for example, who has a website that requests information for the purposes of making an appointment, may only process that information for the purposes of the appointment. Where the hair or nail technician wishes to process this information any further, the company or individual must alert the data subject (the person making the appointment) of this intention.

Example 2: Where a film production company wishes to engage actors or actresses for the purposes of an international set, cannot transfer personal data/information to an overseas company without the consent of the data subject.

Example 3: When a food delivery company collects data and further processes the data to send further marketing or promotional text messages, must get the consent of the data subject.

The examples mentioned above are subject to further requirements and obligations. Please read the Data Protection Act in full or consult an attorney for further guidance.

THE EXEMPTIONS

Under section 36 and 37 gives special exemptions which may apply to a Creative Entrepreneurs. Section 36 of the Act provides that if personal data is being processed with the view to, or consists of, the publication of the publication by any person of any journalistic, literary or artistic material or if the publication would be in the interest of public interest in the freedom of expression. This section gives the Creative Entrepreneurs the right to publish personal data if they reasonably believe that it is incompatible with the special purposes.

Section 37 of the Act states a data controller/company may process personal data where it is processed only for research purposes if the relevant conditions are met and the results will not reveal the identity of the data subject. It must be noted that these section is to be construed in relation to the other sections and overall data standards outlined in the Act.

CONCLUSION

The Data Protection Act, 2020 gives protection to the data subject and places responsibility on the data controller to acquire consent before processing personal data. Creative Entrepreneurs, especially those who may process data in order to market their goods and services, are given a further obligation under the Act. The Act also provides exemptions for journalistic purposes or for individuals/companies that may process personal data for research purposes.