Assessable processing 57 1 the minister may by

Assessable processing
57. (1) The Minister may by Executive Instrument specify actions which
constitute assessable processing if the Minister considers the assessable
processing likely to
(a) cause substantial damage or substantial distress to a data subject,
or
(b) otherwise significantly prejudice the privacy rights of a data subject;
(2) On receipt of an application for registration, the Commission shall
consider
(a) whether the processing to which the notification relates is
assessable, or
(b) if the assessable processing complies with the provisions of this
Act.
(3) The Commission shall within twenty-eight days from the day
of receipt of the application, inform the data controller whether the processing
is likely to comply with the provisions of this Act.
(4) The Commission may extend the initial period by a further period
which does not exceed fourteen days or other period that the Commission may
specify.
(5) The assessable processing in respect of which a notification has been
given to the Commission shall not be carried on unless
(a) the period of twenty-eight days has elapsed, or
(b) before the end of that period, the data controller receives a notice
from the Commission under subsection (3).
(6) A data controller who contravenes this section commits an of- fence
and is liable on summary conviction to a fine of not more than two hundred and
fifty penalty units or to a term of imprisonment of not more than two years or
to both.

Appointment of data protection supervisors
58. (1) A data controller may appoint a certified and qualified data
supervisor to act as a data protection supervisor.
(2) The data protection supervisor is responsible for the monitoring of the
data controller’s compliance with the provisions of this Act.
(3) This section is subject to the exemptions or modifications speci- fied in
the authorisation.
(4) An authorisation under this section may
(a) impose a duty on a data protection supervisor in relation to the
Commission, and
(b) confer a function on the Commission in relation to a data
protection supervisor.
(5) A data protection supervisor may be an employee of the data
controller.
(6) The Commission shall provide the criteria for qualification to be
appointed as a data protection supervisor.
(7) A person shall not be appointed as a data protection supervisor unless
the person satisfies the criteria set by the Commission.
Fees
59. The Minister may by Regulations prescribe fees for the purpose of
sections 49, 50 and 54.
Exemptions
National security
60. (1) The processing of personal data is exempt from the provisions of this
Act for the purposes of
(a) public order,
(b) public safety,
(c) public morality,
(d) national security, or
(e) public interest.
(2) Subject to article 18 (2) of the Constitution, a certificate signed
by the Minister is prima facie evidence of exemption from the provisions of this
Act.