views or opinions, except if they are about someone else; personal
correspondence, home and family;”[8]

The Act prescribes the very limited purposes for which a public body may
collect personal information and these are only where the collection is
prescribed by law; the information is to be collected for the purposes of national
security, public order and law enforcement; or the information is to be collected
for the purposes of public health; or the information relates directly to and is
necessary for an operating programme, function or activity of the public body;
or the information will be used to formulate public policy; [9]

2.6.7. The Act then prescribes that a public body must collect personal information
from the individual concerned personally;
2.6.8. The only exceptions or instances where a public body may collect information
indirectly or from third parties or surveillance is if the individual concerned
consents to such collection of information, or the public body is authorized by
the Zimbabwe Media Commission or the collection is authorized by another
law in force in Zimbabwe; or the information is collected for purposes of
determining the suitability for granting an honour or award, including an
honorary degree, scholarship, prize or bursary; or proceedings before a court
or judicial or quasi-judicial tribunal; or collecting a debt or fine or making a
payment; or law enforcement;[10]

The individual data subject of the collection of information is entitled as of
right to be advised of the fact of and the purpose of the collection of the personal
information and the legal basis for doing so except where the Zimbabwe Media
Commission authorises the public body not to disclose the said fact and or
authority or where to advise the data subject would prejudice law enforcement
and or the purpose of the data collection;[11]

2.6.10. The Act casts a duty on every head of a public body to protect personal
information that is under his custody or control by taking reasonable steps to
ensure that there is adequate security and there is no unauthorised access,
collection, use, disclosure or disposal of such personal information; [12]

Select target paragraph3