What counts as special personal information?
“A responsible party may, subject to section 27, not process personal information concerning— (a) the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or (b) the criminal behaviour of a data subject to the extent that such information relates to— (i) the alleged commission by a data subject of any offence; or (ii) any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings.”
Here — unlike ordinary personal information — the Act does start from prohibition. But it immediately opens gateways, and the structure mirrors section 11: consent is one route among several, not the master key.
The section 27 gateways
“(a) processing is carried out with the consent of a data subject...; (b) processing is necessary for the establishment, exercise or defence of a right or obligation in law; (c) processing is necessary to comply with an obligation of international public law; (d) processing is for historical, statistical or research purposes...; (e) information has deliberately been made public by the data subject; or (f) provisions of sections 28 to 33 are, as the case may be, complied with.”
Six gateways; any one suffices. The deliberately-made-public gateway (e) matters more than people expect — the activist’s published political affiliation, the influencer’s public health journey. And gateway (f) opens the sector authorisations below.
The workhorse gateway: rights and obligations in law
Section 27(1)(b) — “necessary for the establishment, exercise or defence of a right or obligation in law” — is what allows employers to process the medical certificate for sick leave, insurers to assess a disability claim, and attorneys to handle the criminal record in a dismissal dispute. The pattern: where the special information is the evidence a legal right or duty turns on, processing it is permitted — proportionately, securely, and only as far as the right requires. It is the special-information cousin of the court-proceedings accommodations in the general sharing rules.
The sector authorisations: sections 28–33
Parliament then handled the predictable contexts expressly: churches and their members’ beliefs (s 28), race data for employment-equity and B-BBEE compliance (s 29(b)), trade unions and membership (s 30), political parties (s 31), health information for treatment, schemes and employers (s 32), and criminal records and biometrics obtained in accordance with the law (s 33). Note the deliberate contrast: for churches, unions and parties, supplying member information to third parties does require consent (ss 28(3), 30(2), 31(2)) — the targeted consent-only rules that prove ordinary information never had one. Children’s information has its own parallel regime in sections 34–35.