After many false starts over the years (the pandemic causing one last delay this year), the enforcement provisions of POPIA (the Protection of Personal Information Act) have finally become law.
The clock is ticking on the year’s grace period allowed for compliance and every business should be aware of the substantial implications of POPIA compliance, and of the equally substantial penalties and risks associated with non-compliance. Read on for a brief overview of how “personal information” is defined, of the eight principles underlying the Act, and of the various practical issues you should know of and prepare for.
Globally, governments are responding to the vast amounts of information flooding into the public domain due to the growth in companies like Amazon, Facebook and Twitter. As much of this information is personal, POPIA seeks to regulate how this personal information is processed and stored.
South Africa, like many countries, has a constitutional mandate to protect the right to privacy and POPIA is aimed at balancing this right with the necessity of processing personal information – employee salaries is an example.
With the Act now in effect, you have a twelve-month grace period to comply with POPIA. By 1 July 2021, all entities that process personal information need to be in compliance with the Act.
This has substantial implications for business and will be costly and time consuming to implement.
A brief overview
- Firstly, what is personal information? POPIA defines this as including:
- a person’s name (including a juristic person such as a company),
- contact details,
- religion,
- sexual orientation,
- personal views,
- private correspondence,
- health records,
- employment records,
- financial records,
- biometrics (DNA, fingerprints)
- There are eight self-explanatory principles which govern the Act:
- Accountability
- Processing limitation
- Purpose
- Further processing limitation
- Information quality
- Openness
- Security
- Right of access
- Further restrictions apply for the use of
“special personal information” like political affiliation or sexual
orientation.
- A regulatory body known as the Information Regulator has been established with the following powers and duties:-
- Search and seizure powers
- May impose administrative fines
- May sue on behalf of the subject
- Can decide if the law is being complied with
- Receives and acts on complaints
- May issue notices
It is a criminal
offence to make false statements to, or to not comply with notices from, the
Regulator.
- The appointment of an Information Officer. In
terms of POPIA this is deemed to be the head of the organisation, such as the
CEO or sole proprietor. The person may delegate this to another person. The
Information Officer is to register with the Regulator.
The role of this position is to encourage and ensure compliance with the Act, to handle queries from outside the organisation on matters relating to POPIA, to liaise with the Regulator and deal with whatever has been prescribed.
- POPIA makes provision for cross-border uses of
personal information
- In terms of direct marketing, there is a clause requiring opt-in. This is contrary to current laws where the norm is to require opt-out. This means permission must be sought from people whose information will be used, prior to direct marketing taking place. The only exception is in respect of existing customers/clients.
This
transition period is going to be onerous on businesses. They need to determine
what information falls into the Act, how it is used, protected, stored, who has
access to it. Businesses will also need
to get the relevant consents from staff and other stakeholders. What privacy
statements do you need to make, what protocols do you need to put in place over
your information and website?
As there are onerous penalties (a fine of up to R10 million or ten years imprisonment) and these requirements concern the safety of your staff’s (amongst other) information, so it is well worth investing time and taking advice to start getting the right procedures in place now.