Exemptions for personal or household use
The NDPA does not apply to personal data processed by individuals solely for their own or their family’s domestic activities. However, this exemption is not absolute and does not provide cover for actions that violate another person’s fundamental right to privacy. For example:
- Carelessly handling devices that store personal information.
- Allowing unauthorized access to someone else’s personal data.
- Publishing data online, which can be accessed by an indefinite number of people, generally falls outside the “purely personal” exemption.
Exemptions for government processing
The NDPA allows for exemptions for processing by a competent government authority in several cases:
- National security and defense: Data processing necessary for protecting national security is exempt from certain NDPA provisions.
- Criminal investigations: The law can be sidestepped by authorities for the prevention, investigation, detection, or prosecution of criminal offenses.
- Public health emergencies: Exemptions can be invoked to process data for the prevention or control of a national public health emergency.
Important considerations and limitations
- Scope: Exemptions should not be interpreted broadly or applied as a “one-size-fits-all” measure. Data controllers should document their justification for relying on an exemption.
- Abuse and oversight: Critics have expressed concern that exemptions for government processing could be abused to undermine citizens’ privacy rights. To prevent this, regulations should compel strict adherence to data protection obligations and introduce robust oversight.
- Balancing rights: In some cases, such as when investigating fraud, accessing a person’s financial and travel history might be necessary. However, it would be inappropriate to collect unrelated information, such as sensitive medical data, under the same exemption
