POPI Act - are you processing Personal Information lawfully?

The Protection of Personal Information Act 4 of 2013 (POPIA) places a responsibility on Responsible Parties to ensure that they process Personal Information in a lawful manner. 

Chapter 3 of POPIA specifies the eight conditions that apply when processing Personal Information. 

The term “processing” as defined in section 1 of POPIA, broadens the scope of application of the eight conditions. These conditions not only regulate the way in which a Responsible Party uses Personal Information after collection, but also apply to how Personal Information is collected, the reason for collection, and the subsequent storage thereof. 

In a previous blog we provided practical guidance on whom to appoint as a business’s Information Officer, in this article we aim to assist Information Officers and Responsible Parties in understanding the measures required to meet the eight conditions of lawful processing.

What are the eight conditions of lawful processing?

1. Accountability

As mentioned above, the Responsible Party solely will be held liable for ensuring that the conditions for lawful processing are met. No responsibility is placed on the Data Subject to ensure compliance by the Responsible Party prior to providing Personal Information to the Responsible Party.

2. Processing limitations

In terms of section 9 of POPIA, processing should not infringe on the privacy of a Data Subject. This can be achieved by ensuring that the purpose for which Personal Information is processed is adequate, relevant and not excessive.

A Responsible Party may only process Personal Information if they have obtained consent from the Data Subject, or if processing is justified in terms of the following provisions in section 11(1) of POPIA:

• Processing is necessary to conclude an obligation imposed by a contract to which the Data Subject is a party;
• Processing is required by law;
• Processing protects the legitimate interest of the Data subject;
• A public body can only perform a public law duty by processing Personal Information; or
• Processing would be in the legitimate interest of the Responsible Party or a third party.

Where a Data Subject withdraws consent under section 11(2)(b) of POPIA, or objects to processing under section 11(3)(a), the Responsible Party must ensure that they are able to limit any processing of Personal Information thereafter.

The Personal Information should ideally be collected directly from the Data Subject. If this is not reasonably practicable, section 12 of POPIA provides for justifications for collection from another source. These justifications include the following:

• The information was found in the public domain;
• The Data Subject, or a competent person, provided consent that their Personal Information may be collected from another source;
• Collection from another sources will not prejudice the Data Subject;
• The collection from another source is necessary for legal proceedings, is required by law, or is intended to protect the interests of parties.

3. Purpose Specification

A Data Subject cannot provide a Responsible Party with blanket consent to process their Personal Information for any purpose that the Responsible Party deems fit. The Responsible Party is required, under sections 13 and 18 of POPIA, to inform the Data Subject of the specific purpose for which the information was collected. This purpose must correlate with the function of the Responsible Party.

The retention of records for the purpose of “rather safe than sorry” will no longer be tolerated under POPIA. Section 14 of POPIA requires a Responsible Party to delete, destroy or de-identify Personal Information if they have achieved the purpose for which the Personal Information was collected.

Records may be kept for a longer period if–

• required by law;
• the Responsible Party requires the records for a lawful processing purpose relating to their function;
• the retention is required by a contract between the parties; or
• the necessary consent was provided for retaining the records longer than required.

If a Data subject contested the accuracy of their Personal Information, requested the deletion or destruction thereof, or requested that the information be transferred into another automated processing system, the Responsible Party must restrict processing. The restriction may only be lifted if the Data Subjected had provided consent in accordance with section 14(7) of POPIA.

4. Further Processing Limitations

 Further processing of Personal Information occurs when the Responsible Party processes the information for purposes outside the reason for collection. The further processing of information must be compatible with the purpose of collection. Section 15(2) of POPIA outlines the following points when considering compatibility:

• The relationship between collection and the purpose of further processing;
• The nature of the Personal Information;
• The manner of collection; and
• The contractual rights and obligations of each party.

The justification for further processing provided in section 15(3)(a) - (f) of POPIA is similar to justifications previously mentioned, with the addition that further processing may be allowed if an exemption was granted by the Information Regulator in accordance with section 37 of POPIA.

5. Information Quality

A Responsible Party is obligated under section 16 of POPIA to ensure that reasonably practicable steps are taken to ensure that the Personal Information collected is complete, accurate, updated and not misleading. The purpose for which the Personal Information was collected must be considered when aiming for compliance with section 16 of POPIA.

6. Openness

Section 51 of the Promotion to Access of Information Act 2 of 2000 (PAIA), in tandem with section 17 of POPIA, requires a Responsible Party to ensure that processing operations are documented.

A Data Subject should be informed beforehand that their Personal Information will be collected. Section 18 of  POPIA not only requires that a Responsible Party inform a Data Subject of the information being collected, but also that the Data Subject be provided with the name and address of the Responsible Party, the reason for collection, consequences if the Personal Information is not collected, and whether their Personal Information will be transferred to a third party or outside the borders of South Africa. Section 18(4)(a) – (f) of POPIA provides for grounds to justify non-compliance.

7. Security Safeguards

A Responsible Party must prevent loss, damage or unauthorised deletion of Personal Information. In order to meet this requirement, a Responsible Party must comply with section 19(2) of POPIA as follows:

• Identify all foreseeable internal and external risks;
• Establish and maintain safeguards to mitigate these risks;
• Ensure effective implementation of the safeguards; and
• Update safeguards when new risks are identified.

Where an operator processes Personal Information on behalf of the Responsible Party, a contract should be implemented to ensure that the Operator is aware of the rights and duties under POPIA. This written agreement is required by section 20 of POPIA.

In the event that any of these security measures failed, the Responsible Party should notify the Information Regulator and Data Subject of such breach as soon as reasonably possible. Such notice can be given in any of the forms prescribed in section 24(a) – (e) of POPIA. The only justification for not informing a Data Subject of such breach, is if a public body investigating an offence notifies the Responsible Party that such notification will obstruct the investigation.

8. Data Subject Participation

Upon adequate proof of identity, a Data Subject can request, free of charge, that a Responsible Party confirm what Personal Information they hold on the Data Subject. A Data Subject can also request a record of the information held by the Responsible Party, as well as all third parties who have access to their information. According to section 23 of POPIA, this request must be made within a reasonable time, at a prescribed fee, in a reasonable manner and in a form that is understandable. PAIA provides for certain grounds for refusal on which a Responsible Party can rely.

A Data Subject can also request that the Responsible Party correct or delete their Personal Information. Upon such a request, the Responsible Party must either correct or delete the information and then provide the Data Subject with proof thereof to satisfy section 24(4) of POPIA.

Section 25 of POPIA highlights the importance of PAIA when a Data Subject makes any requests under section 23 of POPIA.

In conclusion:

There are numerous responsibilities placed on Responsible Parties to ensure that the Personal Information they process is secure and processed within reason. Furthermore, the Responsible Parties have a duty to ensure that Data Subjects are aware of their rights under POPIA. It is important for business owners as Responsible Parties to be aware of the compliance obligations conferred by POPIA and PAIA respectively and the interaction between these to pieces of legislation.

Failure to comply with any of the processing conditions may result in a penalty being imposed by the Information Regulator.

SERR Synergy assists businesses in ensuring that Personal Information is processed according to legislation, while simultaneously serving the needs your business may have in respect of such data.

We provide a full range of Information Compliance service offerings, by compiling Assessment and Due Diligence Reports, drafting the required Privacy policies, updating your agreements to deal with data considerations, advising on internal data-handling requirements or understanding exactly what data privacy role you fulfil.

About the Author: Demi-Lee Preston completed her BA Law and LLB degrees at the University of Pretoria. She joined the SERR team as an Information Compliance Advisor. She specialises in POPIA and PAIA compliance and has a special interest in Consumer Protection Law.

Sources:

• The Protection of Personal Information Act 4 of 2013
• The Promotion of Access to Information Act 2 of 2000