PROTECTION OF PERSONAL INFORMATION: UNDERSTANDING COMPLIANCE FOR BUSINESS OWNERS

The Protection of Personal Information (POPI) Act of 2003 emanates from section 14 of the Constitution of the Republic of South Africa, which states that all persons have a right to privacy.

This right to privacy includes a right to protection against unlawful collection, retention, dissemination and use of personal information and requires the State to respect, protect, promote and fulfil the rights entrenched in the Bill of Rights.

Introduction to the POPI Act

Approved by the National Assembly on 20 August 2013, after minor amendments proposed by the National Council of Provinces in 2012, the President signed the POPI Act into law on 26 November 2013, subject to certain provisions being implemented and others to be implemented imminently.

The purpose of this blog is to ensure that business owners understand the purpose and principles of the POPI Act in general but in particular now during the Coronavirus lockdown period.

What is the purpose of the POPI Act for South African businesses?

The intention of POPI, labelled an ‘information revolution’, is to ensure that information is properly processed. Its purpose is to give effect to the constitutional right to privacy by safeguarding personal information when processed by a responsible party. A responsible party or person is defined in the Act as the only person who is in possession of personal information and on whom the Act imposes certain obligations in respect to such information.

The POPI Act has the biggest impact on organisations that process loads of personal information, especially personal information, account numbers, children’s information, etc. while the industries most affected are healthcare, financial services and marketing. Every business and organisation, irrespective of their nature, has in their possession certain information that must be protected in their own or a third party’s interest, which includes but is not limited to business trade secrets and personal information of other entities or individuals, such as employees, clients, customers, etc.

In the present technological era and given the growth in technology as a means of communication, especially in a lockdown environment, it is high time for companies to ensure that their data is compliant with the POPI Act. Although South African businesses have been slow on the uptake when preparing for POPI, intelligent and diligent data management can greatly simplify this enormous task.

What are the principles of the POPI Act?

The POPI Act focuses on eight principles to which all entities must adhere in order to protect personal information and thus ensure compliance with the Act.

PRINCIPLE 1 – ACCOUNTABILITY

• This refers to the corporation’s commitment to safeguarding a person’s constitutional right to privacy, which entails accepting responsibility for and taking active measures to mitigate risks associated with being in possession of another person’s personal information.

PRINCIPLE 2 – PROCESS LIMITATION

• Personal information may only be processed in terms of the purpose(s) for which it is collected or subsequently processed with specific consent.

PRINCIPLE 3 – PURPOSE SPECIFICATION

• Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.

PRINCIPLE 4 – FURTHER PROCESSING LIMITATIONS

• Where companies wish to further process information, the additional processing guidelines must be compatible with the purpose for which the information was originally collected.

PRINCIPLE 5 – INFORMATION QUALITY

• It is the company’s responsibility is to take reasonable steps to ensure that the personal information they collect is complete, accurate and not misleading.

PRINCIPLE 6 – OPENNESS

• Companies are required to be unambiguous and transparent when collecting and processing personal information. This is very much an underlying principle of being accountable. An entity doing things covertly cannot be held accountable.

PRINCIPLE 7 – SECURITY SAFEGUARDS

• All personal information should be safeguarded against loss, disclosure, unauthorised access, interference, modification or destruction.

PRINCIPLE 8 – DATA SUBJECT/PARTICIPATION

• Companies are required to allow individuals to access and/or request the modification, correction or deletion of any personal information held by the company (responsible party).

The importance of POPI compliance for businesses

Apart from a constitutional imperative to protect personal information, POPI compliance holds several benefits in terms of the transparency of an organisation’s data and personal information. The location and accuracy of this information are clearly outlined, allowing for the organisation to access and update such information, as well as comply with existing legislation. In this regard, compiling an Information Manual in terms of the Promotion to Access of Information Act (PAIA) becomes an integral information compliance requirement.

Conclusion 

The POPI Act was set to take full effect on 1 April 2020 but this was delayed due to the coronavirus outbreak in the country. The new effective date of the regulations is foreseen to be 1 June 2020. 

SERR Synergy’s approach is to implement compliance in such a way that it delivers business value and does not become a cost centre or overhead, but rather allows for improvement in efficiencies and effectiveness to meet the POPI compliance requirements. First and foremost, POPI compliance presents an ideal opportunity for achieving customer trust. Our professional team of Information Compliance Advisors assist entities to fully comply with procedures as required by POPI, by compiling a Data and Information Protection Report and associated policies where the physical information and cybersecurity risks of organisations are identified and managed. The aim is to maintain the confidentiality, integrity and legitimate availability of data.

About our Author:  Lorette Rebocho has vast experience in information compliance and has been involved in information and ancillary legislation consulting for nearly a decade. She currently focuses on Information Compliance, Consumer Protection, PAIA, POPI, Corporate Governance & Business Administration.

Sources:

https://www.accountancysa.org.za/opinion-piece-preparing-your-data-for-popi-the-time-to-act-is-now/

https://mybroadband.co.za/news/government/345917-south-africas-popi-act-what-you-need-to-know.html

https://www.accountancysa.org.za/influence-are-south-african-companies-prepared-for-popi/