The passage into law of the Protection of Personal Information Bill (POPI) is imminent and, when it does come into effect, it will have significant implications, says Zaid Gardner, senior associate at Edward Nathan Sonnenbergs (ENS).
The purpose of POPI is very clear: to promote the protection of personal information that’s processed by the private and public sectors.
Gardener says this will affect both the citizens whose information is processed by any number of companies and public bodies, and for the companies and public bodies that are doing the processing.
He explains that one of the most significant effects of POPI will be the introduction of comprehensive and dedicated data protection legislation to South Africa.
This is likely to impose significant compliance burdens on South African companies and public bodies.
“Data protection has been around for some time in the developed world, but it’s a relatively new concept for South Africa and will take some getting used to.”
Gardner says the purpose of POPI is very clear: to promote the protection of personal information that’s processed by the private and public sectors.
“The lawmaker has sought to balance the right of privacy that is recognised by the Constitution with various needs and interests, such as the need for economic and social progress within the context of the information society, and the interest in a free flow of information, both domestically and internationally,” he explains.
According to Gardner, the POPI regulates the processing of personal information that is entered in a record, by a company or public body that is domiciled in South Africa, or one that is domiciled elsewhere but uses automated or non-automated means situated in South Africa.
He says this covers a very broad range of activities.
Gardner says the definition of ‘processing’ is very broad, and it seems to include every conceivable action - collecting information, receiving it, storing it, updating it, modifying it, disseminating it, even destroying it.
“The term ‘personal information’ is as broadly defined. It covers, for example, information relating to the race, sex, pregnancy, marital status, ethnicity, colour, sexual orientation, age, health, religion, language and education of a person.
It covers medical, financial, criminal and employment histories.
“The term ‘personal information’ is as broadly defined. It covers, for example, information relating to the race, sex, pregnancy, marital status, ethnicity, colour, sexual orientation, age, health, religion, language and education of a person.
It covers ID numbers, addresses, telephone numbers and blood types, personal opinions, the private correspondence of a person, and the views that other people have of a person.
It even includes the mere name of a person, if the name appears together with other personal information.
A ‘record’ is defined to include recorded information in any form that is in the possession or control of a company or public body, irrespective of whether or not it created it.
However, there are some exclusions available - although these exclusions will have little effect in the corporate world, says Gardner.
POPI does not affect the processing of personal information:
1. In the course of a purely personal or household activity
2. That has been deleted to the extent that it can’t be resurrected
3. By or for the State if it involves national security, defence, public safety, the prevention of crime. Or for exclusively journalistic purposes, by media companies that are subject to a code of ethics that has safeguards for the protection of personal information
4. By Cabinet, Provincial Executive Councils and Municipal Councils
5. If it relates to the exercise of judicial functions
6. If it has been specifically exempted
7. In cases where other legislation regulates the processing of that information
Gardner explains that, in the slightly Orwellian language of POPI, the company or public body that is responsible for processing the information is referred to as the ‘Responsible Party’, whereas the individual, or indeed company, whose information is being processed is the‘Data Subject.’
“POPI provides that the information officer appointed by every company and public body in terms of the Promotion of Access to Information Act (PAIA) will be the ‘Information Protection Officer’ for the purposes of the new legislation, and that this person will ensure that the organisation complies with the Principles, and deals with requests made by outsiders,” says Gardner.
Furthermore, once POPI becomes law, an ‘Information Protection Regulator’ - a supervisory body that will consist of a chairperson and four others members - will be set up, he points out.
The Regulator, who will be independent and subject only to the Constitution, will be responsible for promoting and enforcing the Principles on a national level, and will have the power to investigate complaints.
Gardener says the Regulator will also have the power to draft or approve category-specific or industry-specific codes of conduct.
Once a code of conduct has been created, it will also regulate the processing of information within that category or industry, he adds.
In the next article, Gardner will discuss the 8 information principles of POPI.
Print
