In the past couple of weeks, most of us would have probably received either a WhatsApp message on our cell phones or an email from a business entity asking for your permission to provide access to your personal information in their possession. This has forced one to consider the question of what does The Protection of Personal Information Act 4 of 2013 (“POPIA”) mean for my personal information in the possession of a third party and also the effects that this Act can possibly have on my business activities in the future.
POPIA is aimed at protecting people’s personal information and regulates all processing of personal information. POPIA applies to everyone, therefore all businesses and their service providers have to ensure compliance. POPIA applies when there is processing of personal information, in a record by (or for) a responsible party.
POPIA sets out its purposes in section 2 of the Act. The first purpose of POPIA is to give effect to the constitutional right to privacy, as contained in section 14 of the Constitution of the Republic of South Africa, by safeguarding personal information when processed by a responsible party, subject to justifiable limitations that are primarily aimed at:
1. Balancing the right to privacy against other rights, particularly the right of access to information, and
2. Protecting important interest, including the free flow of information within South Africa and across international borders.
POPIA ensures that the right to privacy is taken seriously and includes a data subject's right to be protected against any unlawful collection, retention, dissemination and use of their personal information.
The operative provisions of POPIA came into effect on 1 July 2020, with a grace period of a year in which companies must ensure that they are compliant. This means that all businesses and business owners must ensure that they are compliant with the provisions of POPIA from 1 July 2021.
Some of the basic requirements to comply with the provisions of POPIA will include the following:
The Responsible Party, which is the company or the business, in terms of POPIA will have to ensure that they:
1. Appoint an Information Officer and Deputy Information Officer within their business and register the Information Officer with the Information Regulator of South Africa.
2. Draft a Privacy Policy or in certain circumstances they must draft a PAIA/POPIA manual, with instructions on how a data subject may access personal information in the possession of the business.
3. Raise awareness amongst all employees about the provisions contained in POPIA.
4. Amend or update contracts with respective operators to ensure compliance with POPIA.
5. Do a Personal Information Impact Assessment (PIIA) in your business, to be able to help you identify and minimise the data protection risks from processing personal information within your business.
6. Update your business security networks to safeguard against potential risks and any possible security breaches.
7. Report any data breaches to the Information Regulator and the respective data subjects.
8. Check that they can lawfully transfer personal information across South African borders to other countries.
9. Only share personal information when they are lawfully able to.
10. Ensure that the data subjects can actively participate in your business. The data subjects may request whether their personal information is held, as well as the correction and/or deletion of any personal information held about them.
The dangers and penalties for non-compliance with the provisions of POPIA can be extreme and can be up to a R10 million fine or even imprisonment of up to ten years in jail if a person is found guilty on the charges for the non-compliance of the provisions of POPIA.
The other penalties can also include damage to your business reputation, civil actions, a loss of valuable customers and you could also fail to attract new customers for your business in the future. But your main motivation for complying with the POPIA should however be to protect your business and clients from any potential harm relating to a breach or non-compliance from the provisions of the POPIA.
It is yet to be seen how stringent the Information Regulator will enforce these penalties as mentioned above, however a business should always rather “be safe than sorry” under these circumstances and ensure that they are fully compliant with the provisions of POPIA when processing personal information.
For any further questions relating to the provisions contained in POPIA or whether or not your business complies with these provisions as mentioned above, feel free to contact Malan Lourens Viljoen Inc. who will be more than happy to offer their advice and expertise on the matter.
Article by Charl Otto (LLB), Candidate Attorney at Malan Lourens Viljoen Inc.
This article is a general information sheet and should not be used or relied on as legal or other professional advice. No liability can be accepted for any errors or omissions or for any loss or damage arising from reliance upon any information herein. Always contact your legal adviser for specific and detailed advice.