Much of the Personal Information that is kept will be in the form of data in databases or systems, and the rest will be in form of documents or records.  Managing these correctly is imperative under POPIA.  This article will build on the records management elements that will need to be implemented in order to fully comply with the Protection of Personal Information Act.

The POPI Act is a new all-inclusive piece of legislation that safeguards the integrity and sensitivity of private information. Companies are required to carefully manage the data capture and storage process of Personal Information within the lawful framework as set out in the Act.

Sections 100 – 106 of the POPI Act deal with instances where parties would find themselves “guilty of an offense”. The most relevant of these are:

• Any person who hinders, obstructs or unlawfully influences the Regulator;
• A responsible party which fails to comply with an enforcement notice;
• Offences by witnesses, for example, lying under oath or failing to attend hearings;
• Unlawful Acts by responsible party in connection with account numbers;
• Unlawful Acts by third parties in connection with account number.

Section 107 of the Act details which penalties apply to respective offenses.

If someone is alleged to be in breach of the POPI Act, a complaint may be submitted to the Information Regulator.

This complaint will be dealt with by an adjudicator.If a person is not happy with the determination of the adjudicator, they can still approach the Information Regulator for another ruling.

Disputes and breaches are covered in great detail in the Act and the Act should be consulted before drawing up Policies and Procedures to handle such matters.

This article must be read in conjunction with the POPI Act which can be downloaded from Act No. 4 of 2013 : Protection of Personal Information Act, 2013

The Act controls the transfer of personal information from South Africa to foreign countries and prohibits this unless: (section 71)

• the person receiving the information is subject to similar laws;
• the subject has agreed to the transfer of information;
• such transfer is part of the performance of a contract which the subject is a party; or
• transfer is for the benefit of the subject and it is not reasonably practicable to obtain their consent and that such consent would be likely to be given. (section 72)

This article must be read in conjunction with the POPI Act which can be downloaded from Act No. 4 of 2013 : Protection of Personal Information Act, 2013

Section 69 of the Act outlaws direct marketing by means of any form of electronic communication unless the data subject has given their consent. Such an electronic communication obviously includes emails, SMSs and automatic calling machines.  A subject can only be approached once to obtain such a consent. Once such consent is refused, it is refused forever.

Slightly different rules apply if the subject is a customer.  Here the customer’s contact details must have been obtained in the context of the sale of a product or a service, the direct marketing by electronic communication can only relate to the suppliers own similar products or services, and the customer must have been given the right to opt out at the time that the information was collected and each time such a communication is sent.

The Act covers Direct Marketing restrictions in great  detail and should be consulted before any direct marketing campaign is considered.

This article must be read in conjunction with the POPI Act which can be downloaded from Act No. 4 of 2013 : Protection of Personal Information Act, 2013