Processing The harms can be in the following form: • physical harms The definition of processing is • economic harms • reputational harms • psychological harms • autonomy harms • discrimination harms • relationship harms19 These harms are not confined to disclosure of sensitive data but even to general personal data. The disclosure of sensitive personal information might lead one or more harms, and even harming others associated with the data subject. Sensitive personal information or data means information that presents a major risk to the data subject if the information is processed without satisfying certain requirements at law. “Any operation or set of operations which are performed upon data, whether or not by automatic means such as obtaining recording or holding the data or carrying out any operation or set of operations on data, including-(a) organisation, adaptation or alteration of the data; (b) retrieval, consultation or use of the data; or (c) alignment, combination, blocking, erasure or destruction of the data”. CLASSIFICATION OF SENSITIVE DATA Data Type Specific harms Racial or ethnic Relationship, physical, economic or psychological Political opinions Discrimination, relationships Political party membership Disclosure that you support a party Religious beliefs/affiliations Relationship, economic, relationship harms Philosophical beliefs Discriminated or harmed based on ideas Trade union or professional physical or discrimination, economic harms Sex life Discrimination, relationships, and psychological Criminal records, education Discrimination, relationships, and psychological Financial employment history Discrimination, relationships, and psychological Gender, age, family status Relationship, discrimination Health or genetic information Discrimination, economic harms and relationship harms 19 In comparison, POPIA under Section 3(4) defines automatic to mean that there is equipment that is capable of operating automatically in responses to instructions given for purposes of processing information. Danielle Keats Citron & Daniel J. Solove (2022). 12 M I S A Z I M B A B W E • G U I D E This definition means that when data is collected from an individual, there are means and ways that are used to make that data relevant or usable. For instance, it can be recording of your cell phone number in a database; or it can be correction of your home address with the local council who are not sending bills or are sending erroneous readings of bills; it can be the destroying of COVID-19 test results and associated diagnosis used for travelling purposes by a medical laboratory. The Act doesn’t define what automatic processing is but mentions automatic data processing in several sections including Section 25. T O T H E Z I M B A B W E A N C Y B E R A N D D A T A P R O T E C T I O N A C T - 2 0 2 2