Globally, governments are responding to the vast amounts of information flooding into the public domain due to the growth in companies like Amazon, Facebook and Twitter. As much of this information is personal, POPIA seeks to regulate how this personal information is processed and stored.
South Africa, like many countries, has a constitutional mandate to protect the right to privacy and POPIA is aimed at balancing this right with the necessity of processing personal information – employee salaries is an example.
With the Act now in effect, you have a twelve-month grace period to comply with POPIA. By 1 July 2021, all entities that process personal information need to be in compliance with the Act.
This has substantial implications for business and will be costly and time consuming to implement.
A brief overview
Firstly, what is personal information? POPIA defines this as including:
There are eight self-explanatory principles which govern the Act:
- Processing limitation
- Further processing limitation
- Information quality
- Right of access
Further restrictions apply for the use of “special personal information” like political affiliation or sexual orientation.
A regulatory body known as the Information Regulator has been established with the following powers and duties:
It is a criminal offence to make false statements to, or to not comply with notices from, the Regulator.
The appointment of an Information Officer. In terms of POPIA this is deemed to be the head of the organisation, such as the CEO or sole proprietor. The person may delegate this to another person. The Information Officer is to register with the Regulator.
The role of this position is to encourage and ensure compliance with the Act, to handle queries from outside the organisation on matters relating to POPIA, to liaise with the Regulator and deal with whatever has been prescribed.
POPIA makes provision for cross-border uses of personal information
In terms of direct marketing, there is a clause requiring opt-in. This is contrary to current laws where the norm is to require opt-out. This means permission must be sought from people whose information will be used, prior to direct marketing taking place. The only exception is in respect of existing customers/clients
This transition period is going to be onerous on businesses. They need to determine what information falls into the Act, how it is used, protected, stored, who has access to it. Businesses will also need to get the relevant consents from staff and other stakeholders. What privacy statements do you need to make, what protocols do you need to put in place over your information and website?
As there are onerous penalties (a fine of up to R10 million or ten years imprisonment) and these requirements concern the safety of your staff’s (amongst other) information, so it is well worth investing time and taking advice to start getting the right procedures in place now.
The Protection of Personal Information Act, Act 4 of 2013, and Regulations are downloadable from the University of Pretoria’s “Laws of South Africa” website – find them under “Constitutional Law”.
For additional reading:
POPIA: A Guide to the Protection of Personal Information Act of South Africa on the Werksmans website.
“Knowing the basics is a good place to start” on the Popi Compliance website here.The article is a general information sheet and should not be used or relied upon as professional advice. No liability can be accepted for any errors or omissions nor for any loss or damage arising from reliance upon any information herein. Always contact your financial adviser for specific and detailed advice.