How Personal Information Needs to be Handled

Any organisation or person who keeps personal information must take steps to prevent the loss, damage, and unauthorized destruction of the personal information.  In terms of Section 19, they are also required to prevent unlawful access to, or unlawful processing of this personal information.

All risks have to be identified and then safeguards must be established and maintained against these risks.  Regular verification that the safeguards are being effectively implemented is required. Safeguards are to be updated in response to any new risks or identified deficiencies in existing safeguards.

Any person processing personal information on behalf of an employer must have the necessary authorization from the employer to do so.  They must also treat the personal information as confidential and not share this information without the following the required processes. (section 20). The person must have a written contract with their employer in which they are specifically obliged to maintain the integrity and confidentiality of the personal information and to implement the established safeguards against identified risks.

Data Subject Rights

Everyone has the right to be informed if someone is collecting their personal information, or if their personal information has been accessed by an unauthorized person. In addition, they have the right of access to their personal information and to require that personal information be corrected or destroyed, or they may object to their personal information being processed.

The Act does not apply to personal information processed

• in the course of a personal or household activity,
• or where the processing authority is a public body involved in national security, defense, public safety, anti-money laundering,
• or the Cabinet or Executive Council of the Province
• or as part of a judicial function.

Personal information can only be processed: (Section 11)

• with the consent of the “data subject”; or
• if it is necessary for the conclusion or performance of a contract to which the “data subject” is a party; or
• if it is required by law; or
• if it protects a legitimate interest of the “data subject”; or
• if it is necessary to pursue your legitimate interests or the interest of a third party to whom the information is supplied.

Everyone has the right to object to having their personal information processed.  They have the right to withdraw their consent, or object if they can show legitimate grounds for their objection.

The POPIA Act Applies to Everyone

The Act applies to any person or organisation who keeps any type of records relating to the personal information of anyone, unless those records are subject to other legislation which protects such information more stringently.

It therefore sets the minimum standards for the protection of personal information. It regulates the “processing” of personal information. “Processing” includes collecting, receiving, recording, organizing, retrieving, or using such information; or disseminating, distributing or making such personal information available. 

The Act will also relate to records which are already in the possession of the entity or person doing the processing.  

This article must be read in conjunction with the POPI Act which can be downloaded from Act No. 4 of 2013 : Protection of Personal Information Act, 2013

What POPIA means for business

The POPI Act ensures that the right to privacy is taken seriously and includes a data subject's right to be protected against any unlawful collection, retention, dissemination and use of their personal information.

Companies are required to receive consent from individuals before they can obtain, retain and process personal information for communication or any other purpose. As per "Conditions for lawful processing" the definition of "Personal Information" includes contact details, demographic information, personal history, as well as communication records.

The POPI Act highlights the need for a greater understanding of the manner in which personal information is stored and processed.  This means that the systems, processes and how logical and physical access is maintained and managed for the systems and areas housing personal information al need to be considered.

Protection of Personal Information requires extra vigilance in all aspects of physical and information security.  The basis of the POPI Act is to protect personal information and prevent information from being exposed to unauthorised persons.  As a result, this implies an obligation to protect information relating to individuals and juristic entities from any damage, including financial fraud, identity theft, misuse and the abuse of personal information.

The POPI Act requires that a set of streamlined processes and systems must be established that can easily identify where personal information is stored, understand how this information is processed physically and electronically, who has access to this information, as well as for what purpose it is required.

This article must be read in conjunction with the POPI Act which can be downloaded from Act No. 4 of 2013 : Protection of Personal Information Act, 2013

 KEY DEFINITIONS

“data subject” – a person to whom personal information relates.

“direct marketing” –  sending a data subject an electronic communication about goods and services that you are promoting or offering to supply in the ordinary course of business, or requesting a donation of any kind for any reason.

“processing” – any operation or activity concerning personal information.

“record” – any recorded information, regardless of when it came into existence.

“responsible party” – a public or private body or any other person which determines the purpose of and means for processing personal information.

For a full list of definitions, please refer to the POPI Act which can be downloaded from Act No. 4 of 2013 : Protection of Personal Information Act, 2013

Relationship with other Acts

 The POPI Act (POPIA) is just one of many Acts that govern South African law.  When looking at the requirements of the POPI Act, the requirements of other Acts should also be taken into consideration.

The Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PIAI) hold a special relationship.  Both can be seen as "information" laws, and are each on one end of a continuum.  On the one end, PAIA is an "Access" law, all about Freedom of Information.  POPIA on the other end, is about Priivacy - prevention of exposure of information.  They shouldn't be seen as competing, both rather, both are there to help ensure that information is managed correctly.

Below are some of the other Acts that may impact the POPI Act compliance process.

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Close Corporations Act 69 of 1984
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act, No 68 of 2008 
• Copyright Act 98 of 1978
• Electronic Communication and Transactions Act 25 of 2002
• Income Tax Act 58 of 1962
• Intellectual Property Rights from Publicly Financed Research and Development Act 51 of 2008
• International Standard for Records Management (ISO15489)
• Labour Relations Act 66/1995
• National Archives and Records Service of South Africa  Act 43 of 1996
• National Credit Act 34 of 2005
• Promotion of Access to Information Act 2 of 2000 (PAIA)
• Promotion of Administrative Justice Act 3 of 2000 (PAJA)
• Protection of Personal Information Act 4 of 2013 (POPI)
• South African National Standard for Records Management (SANS 15489)
• The Constitution of the Republic of South Africa 1996
• Value Added Tax Act 89 of 1991

 In addition to these Acts, other Industry specific Act, Regulations, Codes of Practice should be considered.  In particular, the King Report on Corporate Governance, (King III and IV) should be considered.