South Africa POPIA

Who is excluded from POPIA compliance? 

POPIA excludes certain types of processing of personal information such as:

• processing done in the course of a purely personal or household activity;
• processing of personal information that has been de-identified to the extent that it cannot be re-identified again;
• processing done by or on behalf of a public body who is either related to national security, through activities that “are aimed at assisting in the identification of the financing of terrorist and related activities, defence or public safety,” or whose purpose is “the prevention, detection, including assistance in the identification of the proceeds of unlawful activities and the combating of money laundering activities, investigation or proof of offenses, the prosecution of offenders or the execution of sentences or security measures, to the extent that adequate safeguards have been established in legislation for the protection of such personal information;”
• processing done “by the Cabinet and its committees or the Executive Council of a province;  
• processing that relates to “the judicial functions of a court referred to in section 166 of the Constitution;”
• “processing of personal information solely for the purpose of journalistic, literary or artistic expression to the extent that such an exclusion is necessary to reconcile, as a matter of public interest, the right to privacy with the right to freedom of expression;”
• exemptions granted by the Regulator as detailed in section 37;
• personal information processed for the purpose of discharging a relevant function as detailed in section 38.
  
  

How can I keep my organization POPIA compliant? 

According to POPIA, in order to be compliant, organizations must  respect 8 principles: 

1. Accountability - as detailed in section 8 of the law, you must ensure compliance with the law;
2. Processing limitation - sections 9 to 12 detail that processing has to be lawful and minimal, consent has to be obtained and proven later on, and objection to processing has to be made available;
3. Purpose specification - according to sections 13 and 14, the personal information of individuals must only be collected in connection with a specific purpose and must not be stored for longer than necessary; 
4. Further processing limitation - “further processing of personal information must be in accordance or compatible with the purpose for which it was collected ” as explained in section 15;
5. Information quality - this is clarified by section 16 which says that as a responsible party your organization has to take “reasonably practicable steps to ensure that personal information is complete, accurate, not misleading and updated where necessary”;
6. Openness - this refers to being transparent both in terms of keeping accurate records and in informing individuals of what is collected, when and for what purpose, according to sections 17 and 18.
7. Security safeguards - sections 19 to 22 explain that you must take security measures to protect the integrity and confidentiality of personal information being processed and in the event of a breach you are obliged to report this to the Information Regulator as well as to inform the affected individual(s).
8. Data subject participation - sections 23 to 25 regulate the way access to personal information should be given to individuals and the way correction of their personal information should be carried out.

In addition to this, keep in mind that special personal information cannot be processed unless the exceptions in section 27, 33, or Chapter 3 of the law apply, for example, if the data subject gave their consent or if processing is necessary to comply with a legal obligation. The same applies to processing of  personal information of children. Also, processing of personal information of children is prohibited unless exceptions in Section 35 apply, in which case processing is allowed. The same applies to special personal information which is also prohibited according to section 26, unless your organization falls under one of the exceptions outlined in sections 27 through 33.

Similar to the GDPR’s Data Protection Officer, POPIA establishes a need for an Information Officer whose responsibilities include

• “the encouragement of compliance, by the body, with the conditions for the lawful processing of personal information;
• dealing with requests made to the body pursuant to this Act;
• working with the Regulator in relation to investigations conducted pursuant to Chapter 6 in relation to the body;
• otherwise ensuring compliance by the body with the provisions of this Act; and
• as may be prescribed.”

Once you have appointed an Information Officer, the law requires you to register them with the Information Regulator via the registration portal setup for this purpose. In addition to an Information Officer, you are also encouraged to appoint Deputy Information Officers, if there is need to support Information Officer to fulfill their responsibilities. Deputy Information Officers need to be registered with the Information Regulator as well, the number of Deputy Information Officers you may have is unlimited.

What data access rights does POPIA grant? 

Section 5 of the law defines 9 rights that individuals have in connection with the processing of their personal information. 

1. Right to be informed: individuals have a right to be informed that personal information is being collected about them, and if that is the case, that their information has been subject to a breach.
2. Right to access: individuals have the right to request access to their personal information that you hold about them.
3. Right to correct: where necessary, a request can be made for the correction of personal information that is “inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.”
4. Right to destroy or delete: same as above, if the personal information is “inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully” an individual can ask you to delete it, and if the information is no longer necessary for serving the initial purpose for its collection, it has to be destroyed upon request.
5. Right to object (or withdraw consent): an individual can at any time withdraw consent for the processing of their personal information “ on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its personal information.”
6. Right to object to processing for direct marketing purposes by means of unsolicited electronic communications: individuals have a right to object to the processing of their personal information if this is done for the purposes of direct marketing via unsolicited electronic communications defined as being done by any “means of any form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mail.”
7. Right to not be subject to decisions based on automated processing: individuals can object to being profiled meaning they have a right to “not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its personal information intended to provide a profile of such person.”
8. Right to complain to the Information Regulator: an individual may submit a complaint to the Information Regulator “regarding the alleged interference with the protection of the personal information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator.”
9. Right of private action: individuals have a right “to institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99.”

How should your organization address data subject access requests under POPIA?

POPIA, unlike other privacy regulations, is less specific regarding timeframes for replying to data subject access requests, monetary charges that can be imposed, or informing individuals of their rights.

In the case of a request for access, individuals may submit such a request and, once they’ve provided “adequate proof of identity,” they should obtain access

• “within a reasonable time;
• at a prescribed fee, if any;
• in a reasonable manner and format; and
• in a form that is generally understandable.”

If you require the individual to pay a fee for services provided, you must give them a written estimate before providing the service and you may require them to pay a deposit for all or part of the fee.

If you refuse the request for access, you must provide the reasons for this as well.

When you receive a request for correction, deletion or destruction of personal information, you are required to perform one of the three actions, but only if the information is “inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.” Once this is done, you are required to provide proof to the individual.

For all the other requests, as well as for the ones above, the timeframe specified by the text of the law is “as soon as reasonably practicable” with no mention of an extension. While every organization should review their internal practices to determine what they believe is reasonable, a best practice may be to model timelines provided in other data privacy regulations such as GDPR or similar. 

Enforcement and penalties

The regulating authority for POPIA is the Information Regulator, who is an independent body that has the power to enforce the law as follows:

• “has jurisdiction throughout the Republic;
• is independent and is subject only to the Constitution and to the law and must be impartial and perform its functions and exercise its powers without fear, favor or prejudice;
• must exercise its powers and perform its functions in accordance with this Act and the Promotion of Access to Information Act; and
• is accountable to the National Assembly.”

Any individual may submit a complaint to the Regulator if they believe that their personal information has been compromised.

Penalties can range between 12 months prison for less serious offenses, or both a fine and imprisonment, and to 10 years of prison for serious offenses, or both a fine and imprisonment, and the amount of the fine payable may not exceed 10 million Rand ($ 552,555 at the time of writing).

Data Subject Rights - GDPR vs. POPIA