| (1) | The prohibition on processing personal information of children, as referred to in section 34, does not apply if the processing is— |
| (b) | necessary for the establishment, exercise or defence of a right or obligation in law; |
| (c) | necessary to comply with an obligation of international public law; |
| (d) | for historical, statistical or research purposes to the extent that— |
| (i) | the purpose serves a public interest and the processing is necessary for the purpose concerned; or |
| (ii) | it appears to be impossible or would involve a disproportionate effort to ask for consent, |
and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the child to a disproportionate extent; or
| (e) | of personal information which has deliberately been made public by the child with the consent of a competent person. |
| (2) | The Regulator may, notwithstanding the prohibition referred to in section 34, but subject to subsection (3), upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process the personal information of children if the processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the child. |
| (3) | The Regulator may impose reasonable conditions in respect of any authorisation granted under subsection (2), including conditions with regard to how a responsible party must— |
| (a) | upon request of a competent person provide a reasonable means for that person to— |
| (i) | review the personal information processed; and |
| (ii) | refuse to permit its further processing; |
| (i) | regarding the nature of the personal information of children that is processed; |
| (ii) | how such information is processed; and |
| (iii) | regarding any further processing practices; |
| (c) | refrain from any action that is intended to encourage or persuade a child to disclose more personal information about him- or herself than is reasonably necessary given the purpose for which it is intended; and |
| (d) | establish and maintain reasonable procedures to protect the integrity and confidentiality of the personal information collected from children. |
