83 • • • • • • • • • • • informational privacy, the court ought to take into account the fact; Whether the information was obtained in an intrusive manner, Whether it was about intimate aspects of an applicants’ personal life; Whether it involved data provided by an applicant for one purpose which was then used for another purpose; and Whether it was disseminated to the press or the general public or persons from whom an applicant could reasonably expect that such private information would be withheld. Biometric data, by its very nature, provided information about a given person, and was therefore personal information that was subject to the protection of privacy in article 31 of the Constitution. The Data Protection Act, No 24 of 2019 adopted at section 2 the definition of personal data that was in the European Union’s General Data Protection Regulations (GDPR), namely, any information which was related to an identified or identifiable natural person. The unique attributes and identifiers that were included in the definition of biometric data as defined in section 3 of the Registration of Persons Act, GPS coordinates, and the data collected by NIIMS as evidenced by the NIIMS data capture form, clearly fell within the above definition of personal data. The qualification of biometric data as personal had important consequences in relation to the protection and processing of such data, and as such invited a risk of violation of the right to privacy in the event of inadequate protection measures. The main utility of biometric data was with regard to identification of a natural person. Therefore, the only relevant consideration as regards the necessity of biometric data was its utility with respect to the authentication or verification of a person. The article 29 Data Protection Working Party in its Working Document on Biometrics identified the necessary qualities required of biometric data for purposes of authentication and verification were On the right to privacy the court held that Information privacy included the rights that the data should have attributes that were: of control that a person had over personal Universal, in the sense that the biometric element exists information. in all persons; Unique, in that the biometric element had to be distinctive to each person, and Permanent, in that the biometric element remained permanent over time for each person, and a data subject was in principle not able to change those characteristics The biometric attributes required by the impugned amendments met those criteria, as most of them were universal and unique to the data subjects. Unlike other biometric characteristics, the technique used in DNA identification, which was a DNA comparison process, did not allow for the verification or identification to be done “in real time”, the comparison was also complex, required expertise, and took time. Given the nature and the amount of personal information contained in cellular samples, their retention per se had to be regarded as interfering with the right to respect for the private lives of the individuals concerned. That only a limited part of that CITIZENSHIP AND NATIONALITY RIGHTS CASE DIGEST