526 No. 41 of 2021] Act No. 3 of 2021 Electronic Government (3) Subject to the other provisions of this Act and the Data Protection Act, 2021, data provided under subsection (1) shall be provided with metadata. (4) The President may, on the recommendation of the Division, make Regulations for use of the data under this section including commercial and non-commercial use, conditions of use and exclusion of liabilities and warranties. (5) For the purposes of this section “metadata”means a set of data that gives information about other data. Electronic forms 19. Where a legal provision stipulates the use of a form providing a signature field, the signature field may be omitted from a version of the form intended for electronic submission to the public body where an e-signature is used. Data protection Act No. 3 of 2021 20. (1) A public body shall implement data protection measures in accordance with the Data Protection Act, 2021. Act No. 3 of 2021 Identity and authenticity Act No. 3 of 2021 (2) Data protection under this Act shall be enforced in accordance with the Data Protection Act, 2021. 21. (1) A data controller may only grant a right of access to personal data in which there is a protected interest in confidentiality within the meaning of the Data Protection Act, 2021 in the context of electronic communications in the public sector, where the unique identity of the person desiring access and the authenticity of that person’s request is validated. (2) The validation under subsection (1) shall be provided in a form which can be verified electronically. (3) A data controller shall, where only recurring identity can be validated, grant access only in respect of personal data which the person requesting access has made available using that same identity. (4) The identification of a person may be requested in communications with a data controller by a public body, where it is an essential requirement for performance of a task assigned to that data controller under any law. Restriction on use of personal information Act No. 3 of 2021 22. A public body shall, without prejudice to the Data Protection Act, 2021, ensure that personal data is— (a) kept and used only for specified and lawful purposes for which the data is collected and processed; and (b) not kept for longer than is necessary for the purposes for which the data is collected and processed or as required by any law.