Understanding the role of an Information Officer as per the POPI Act
Understanding the role of an Information Officer as per the POPI Act
Prior to the commencement of the Protection of Personal Information Act 4 of 2013 (POPI), the role of the Information Officer was determined by the provisions of the Promotion of Access to Information Act 2 of 2000 (PAIA).
In a previous blog we discussed 'Guidelines on the implementation of the POPI Act', this blog aims to provide an overview of the expansion of the information officer’s role brought about by POPI Act.
What are the responsibilities of an information officer under PAIA?
An information officer must–
- encourage and ensure overall compliance with PAIA;
- create, maintain and update a PAIA manual for the entity;
- evaluate and approve requests for access to information received in terms of the grounds set out in PAIA, within the time constraint or any extended period.
What are the responsibilities under the POPI Act and POPI regulations?
An information officer must–
- encourage and ensure overall compliance with POPI;
- encourage compliance with conditions for the lawful processing of personal information;
- deal with requests made by the Information Regulator or data subjects (individuals);
- work with the Regulator in relation to investigations conducted in accordance with the relevant provisions of POPI;
- develop, implement and monitor a compliance framework;
- ensure that a personal information impact/risk assessment is performed to guarantee that adequate measures and standards exist within the entity;
- develop, monitor, maintain and make available a PAIA manual;
- develop internal measures and adequate systems to process requests for access to information;
- ensure that internal awareness sessions are conducted regarding the provisions of POPI, the regulations and any codes of conduct or information obtained from the Regulator.
What is the process for appointing an information officer?
- As yet no process is required to be followed by an entity for the appointment of an individual as an Information Officer. This position is automatically assigned to the head of an organisation (be it the chief executive officer or otherwise).
- An entity is entitled to appoint as many deputy information officers as may be necessary to perform the duties of an Information Officer as required by the relevant legislation.
- Since the Information Regulator recently published draft guidelines regarding the registration of Information Officers with the Regulator, we anticipate that registration would become a compliance factor in the near future. The draft guidelines state that all information officers should be registered by 3 March 2021 but this is dependent on the progress made in developing the electronic portal.
- The draft guidelines published by the Information Regulator stated that all Information Officers should be registered by 30 June 2021. The latest Media Release published by the Information Regulator confirmed that no Responsible Party will be held liable for not registering by 30 June 2021. It was confirmed that the portal is experiencing some “technical glitches”. The Information Regulator will inform Responsible Parties on alternative registration processes in due course.
Conclusion
It is clear that a person appointed as the Information Officer is entrusted with great responsibility and a duty to ensure that the entity complies with both POPI and PAIA. Since neither POPI nor PAIA specifically provides for the qualifications that a person should have in order to hold the position of Information Officer, the executives must use their discretion to appoint a responsible senior person with a sound acumen to fulfil this important responsibility. These tasks can due to the risks associated to the company not be assigned to lower level staff such as receptionists and junior admin staff.
About the Author: Monique van der Merwe completed her B.Consumer Science degree at the University of Pretoria. She joined our team in July 2018 and currently holds the title of “Information Compliance Advisor”. She specialises in compliance with the Consumer Protection Act (CPA) as well as POPI and PAIA. This includes compiling legal compliance reports and developing policies along with the other assessment aspects relating to consumer protection legislation. She drafts and submits PAIA manuals to the Human Rights Commission and also compiles and implements Data and Information Protection Reports to identify risks associated with information security in each department of an organisation.
Sources:
https://www.michalsons.com/focus-areas/privacy-and-data-protection/information-officer-popi-paia
