Protection of Personal Information Act - Section 9
"Personal information must be processed
(a) lawfully, and
(b) In a reasonable manner that does not infringe the privacy of the data subject ".
So, what is the purpose?
Business process descriptions provide the context for processing personal information – i.e. the specific purpose.
Data collection must be proportionate to the purpose – minimal .
Data processing must be for a legitimate purpose.