Exemptions and exclusions from the Protection of Personal Information Act
Exemptions and exclusions from the Protection of Personal Information Act
All businesses in South Africa need to be fully compliant with the Protection of Personal Information Act (POPI Act) by 1 July 2021 as the Information Regulator will start enforcing compliance one year after the commencement of the POPI Act in July 2020.
Section 6 of the Act relating to the exclusions has caused confusion among business owners as to whether or not they are excluded from being compliant.
It is important firstly to distinguish between exclusion and exemption.
What is the difference between exclusion and exemption?
- If you are excluded, then it simply means that you do not fit the definition in the first place. For example, something is being excluded from being regulated by a specific law because it is regulated elsewhere by a different law.
- Exempted means that you do fit the definition but are specifically ‘excused’ from the list. For example, something is exempted from being regulated or is being less regulated because it already meets certain conditions.
What does the POPI Act exclude?
The POPI Act automatically does not apply to the processing of Personal Information in the following instances:
- Personal or household activity;
- Data that has been de-identified to the extent that it cannot be re-identified again;
- Processing Personal Information by or on behalf of a public body—
- which involves national security
- for the purpose of prevention, detection, and assistance in the identification of the proceeds of unlawful activities;
- By the Cabinet and its committees or the Executive Council of a province;
- Judicial functions of a court; or
- Terrorist and related activities.
Special notice for exemptions
The Regulator may grant certain exemptions to a Responsible Party, by notice in the Government Gazette, only in the following instances:
- Public Interest to process information outweighs privacy of Data Subject, which includes–
- interest of National Security
- prosecution or offences
- economic and financial interest
- historical, statistical or research activities
- freedom of expression
- Processing involves a clear benefit to Data Subject or Third Party.
How to determine whether your company should be compliant
If there is still any confusion as to whether your company should be compliant, we have identified 8 questions “as a test” to determine whether your company should comply.
If you answer ‘yes’ to any of the following questions, you do not have to comply with the POPI Act.
- Do we process personal information that is not entered into a record? (A Record is defines any recorded information, regardless of form or medium, including written, electronic information, label, marketing, image, film, map, graph, drawing or tape which is in the possession or under the control of the Company, irrespective of whether it was created by the Company and regardless of when it came into existence)
- Do we process personal information in the course of purely household activities?
- Is the information we process de-identified so that it is no longer regarded as personal information?
- Are we a public body that protects national security?
- Are we a public body that prosecutes offenders?
- Are we a cabinet (and its committees) or the executive council of a province?
- Are we a court referred to in section 166 of the Constitution and process for judicial functions?
- Do we process personal information for purely journalistic, artistic or literary purposes?
Businesses that do not comply with the POPI Act will be paying fines of up to R10 million and can be blacklisted. Their officials could even face imprisonment for periods ranging from 12 months to 10 years. The Information Regulator may also prohibit your organisation from processing information on a daily basis. Reputational damage for non-compliance is a material risk which may lead to directors being declared unfit to be a director in terms of the Companies Act.
SERR Synergy assists businesses in ensuring that personal information is processed in accordance with legislation, while simultaneously serving the needs of your business with regards to the role such data plays in your business operations. We provide a full range of Information Compliance service offerings, be it compiling Data and Information Protection Reports, drafting of required Data Privacy policies, updating your agreements to handle data considerations, advising on internal data handling requirements, training to staff understanding exactly what data privacy role you fulfil and information compliance.
We recommend that businesses start the compliance process sooner rather than later. If you want your organisation to be POPI compliant and ready by 1 July 2021, feel free to contact us for more information.
About the Author: Retha van Zyl completed her BCom Hons (Economics and Risk Management) studies at the North West University. She joined our team in January 2016 and currently holds the title ‘Information Compliance Advisor’. She specialises in POPI and PAIA compliance, which includes compiling and submitting PAIA Manuals to the Human Rights Commission. She also compiles the Data and Information Protection Report to identify risks associated with information security and drafts Information Security policies for procedural compliance in each department within an organisation.
Sources:
https://qsf.fs.quoracdn.net/-4-images.favicon.ico-26-ebf6a9e7f7b4576d.ico
