27 The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. 7.Individual Participation Principles An individual should have the right: (a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; (b) to have communicated to him, data relating to him (i)within a reasonable time; (ii)at a charge, if any, that is not excessive; (iii)in a reasonable manner; and (iv) in a form that is readily intelligible to him; (c) to be given reasons if a request is made under subparagraph (a) and (b) is denied, and to be able to challenge such denial; and (d) to challenge data relating to him and, if the challenge is successful, to have the data erased, rectified, completed or amended. 8.Accountability Principle A data controller should be accountable for complying with measures that give effect to the principles stated above. In addition to the eight privacy principles, the Guidelines set out principles for free flow of data and legitimate restrictions, national implementation and international co-operation. 4.3.4 These eight principles are generally agreed to deal with the most important issues regarding the protection of personal privacy in an electronically connected world. More importantly for Botswana and other jurisdictions wishing to do business globally through electronic media, they are reflected in the European Community Parliament and Council Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data.15 Noting that data processing systems are intended to be servants and must respect fundamental rights of individuals, including privacy, the Directive sets out Principles Relating to Data Quality. 4.3.5 15 Article 6 indicates that Member States [through their national legislation] must provide that personal data must be: • Processed fairly and lawfully; Directive95/46EC, October 24, 1995, Official Journal L 281, 23/11/1995 P. 0031-0050.