views or opinions, except if they are about someone else; personal correspondence, home and family;”[8] 2.6.6. The Act prescribes the very limited purposes for which a public body may collect personal information and these are only where the collection is prescribed by law; the information is to be collected for the purposes of national security, public order and law enforcement; or the information is to be collected for the purposes of public health; or the information relates directly to and is necessary for an operating programme, function or activity of the public body; or the information will be used to formulate public policy; [9] 2.6.7. The Act then prescribes that a public body must collect personal information from the individual concerned personally; 2.6.8. The only exceptions or instances where a public body may collect information indirectly or from third parties or surveillance is if the individual concerned consents to such collection of information, or the public body is authorized by the Zimbabwe Media Commission or the collection is authorized by another law in force in Zimbabwe; or the information is collected for purposes of determining the suitability for granting an honour or award, including an honorary degree, scholarship, prize or bursary; or proceedings before a court or judicial or quasi-judicial tribunal; or collecting a debt or fine or making a payment; or law enforcement;[10] 2.6.9. The individual data subject of the collection of information is entitled as of right to be advised of the fact of and the purpose of the collection of the personal information and the legal basis for doing so except where the Zimbabwe Media Commission authorises the public body not to disclose the said fact and or authority or where to advise the data subject would prejudice law enforcement and or the purpose of the data collection;[11] 2.6.10. The Act casts a duty on every head of a public body to protect personal information that is under his custody or control by taking reasonable steps to ensure that there is adequate security and there is no unauthorised access, collection, use, disclosure or disposal of such personal information; [12]