TerraLex Guide to Data Protection

The Protection of Personal Information Act (POPI Act) and in section 14 of the South African Constitution which confers the right to privacy.

The data protection laws in this jurisdiction apply to both natural and juristic persons.

In this jurisdiction, the right to privacy is limited, and to prove an infringement will be fairly difficult. There is established case law on the protection of bodily privacy, the privacy of communications and territorial privacy. The POPI Act has been enacted to protect data which constitutes personal information such as names, e-mail addresses, biometric data etc.

There are 3 main exemptions according to section 37 and 38 of the POPI Act: 1. If complying with the act will impede their function, then public bodies such as the office of the Public Protector are exempt from the POPI Act. 2. Where public interest outweighs the interference with one's privacy. A few examples would be where breach is in the interest of:

• National security
• The prevention, detention, and persecution of offences
• Historical, statistical or research activity
• The special importance of the interest in freedom of speech.

3. The benefit to the person whose privacy is being breached outweighs the fact that their privacy is being breached.

Data owners can keep records of personal information for historical, statistical or research purposes, but these data records must not be kept for any other purposes.

Section 11 states that personal information may only be processed if: 1. the data subject consents. 2. the processing is required for the performance or conclusion of a contract to which the data subject is a party. 3. processing complies with an obligation imposed by law. 4. processing protects one of the data subject’s legitimate interests. 5. necessary for the performance of a public law duty by a public body; or 6. necessary for pursuing the legitimate interests of the responsible party.

Section 11 allows a data subject to withdraw their consent at any time. A data subject may also object to the processing of personal information on reasonable grounds or for the purposes of direct marketing unless legislation provides for the processing.

After an objection, the personal information may not be processed.

Section 12 of POPIA provides that personal information must be collected directly from the data subject unless an exception applies.

The exceptions include, but are not limited to, where information is contained in a public record if the collection would not prejudice an interest or if the collection is in the interests of national security.

The conditions for processing personal data are: 1. Accountability which means appointing someone responsible for compliance with the POPI Act and having policies and procedures in place 2. Processing Limitations meaning that consent must be obtained from the data subject for their data to be processed and only information that is required for the purpose of collection must be collected. 3. Data must be used for the specific purpose which has been explicitly defined and the data subject is aware of and has consent to. 4. Data may not be processed for a secondary purpose unless the secondary purpose is compatible with the original purpose. 5. Data must be kept secure, and the risk of loss, unauthorized access and destruction must be mitigated against.

No. There is no specific retention period of data prescribed by the POPI Act.

Yes. A record must be made of the manner in which personal data is processed and for what purpose it was processed.

The Information Regulator (South Africa) is the data protection national authority. Their role is mainly to investigate complaints and impose penalties on persons who breach the POPI Act.

The concept of a DPO is recognized in our law – but referred to as an Information Officer. The Information Officer of an organisation is an important person when it comes to information. By default, every single organisation in South Africa has one. The law (more particularly the Promotion of Access to Information Act or PAIA) automatically specifies which person in each organisation is the information officer by default. The position of the DPO is an automatic appointment, with the CEO or head of an organization designated as the de facto information officer in terms of PAIA. In addition to an information officer, the responsible party is entitled to appoint or designate deputy information officers as required to perform the duties placed on the information officer.

The information officer and the deputy information officer are required to be registered with the Information Regulator and their details are to be included in the manual prepared in terms of PAIA. Responsible parties are encouraged to register their information officers, but at the moment, a failure to do so is not considered an offence.

The officer is an important person because they are responsible for ensuring that the organisation complies with PAIA. An information officer of a responsible party (or body) must:

1. encourage and ensure compliance with PAIA in accordance with the body’s definition of compliance,
2. create, maintain, and update a PAIA manual for the body,
3. evaluate and approve requests for access to information received in terms of the grounds set out in PAIA, within the time constraint or any extended period.

The POPI Act regulates cross-border data transfers in instances where a party in South Africa sends personal information to be processed in another country. This Act also applies in instances where a person in another country sends personal information to South Africa for processing. Section 72 of POPI deals with transfers of personal information outside South Africa or transborder information flows. It essentially says that a responsible party may not transfer personal information about a data subject to a third party who is in a foreign country unless certain protections are in place. For example, if:

1. The foreign country has a law that provides adequate protection.
2. There are binding corporate rules that provide adequate protection.
3. There is an agreement between the sender and the receiver that provides adequate protection.
4. The data subject consents.
5. The transfer is necessary for the responsible party to perform in terms of a contract.

No.

There are no specific security standards, but the POPI Act states that the personal data must be kept in such a way that it is free from unauthorized access, modification or from being deleted. Under section 19 of POPI, responsible parties are required to secure the integrity and confidentiality of all personal information in their possession by taking “appropriate, reasonable technical and organisational measures” to prevent the loss or damage to personal information and any unlawful access to or processing of personal information.

Reasonable and appropriate measures require parties to:

1. identify all foreseeable internal and external risks to the personal information they possess;
2. establish and maintain safeguards against the risk which they identify;
3. regularly verify that their safeguards are being implemented effectively; and
4. continuously update the safeguards in response to new risks or deficiencies identified.

Yes. The POPI Act states that when personal data has been unlawfully accessed then the data subject must be notified of the breach.

Section 107 of the POPI Act sets out the sanctions applicable to the respective offences. Serious offences can attract the maximum penalty of a R10 million fine or imprisonment for a period not exceeding 10 years or both a fine and such imprisonment.

Not at present.