INTRODUCTION
The Protection of Personal Information Act 4 of 2013 (“POPIA”) focuses on the privacy and protection of the data subjects [1] personal information. Therefore, it can be said that the purpose of POPIA applies to the processing of personal data, that relates to a data subject, by a responsible party or operators. POPIA provides lawful processing conditions by responsible parties to process the personal information of data subjects in a manner that is clearly defined within the Act.
The following critical discussion will analyze eight lawful conditions for processing of personal information in terms of POPIA and the readiness of South African Business for the implementation of the POPIA. Due to implementation of Information Regulator [2] by the President of the Repuiblic of South Africa on 01 December 2016 there has been steady growth for the need of compliance of the POPIA by responsible parties. [3]
THE EIGHT LAWFUL CONDITIONS FOR PROCESSING OF PERSONAL INFORMATION IN TERMS OF POPIA
a. What Would Qualify the Compliance of the Eight Conditions of Lawful Processing of Personal Information
The lawful processing of a data subject’s personal information must be, conducted lawfully and be done in a reasonable manner, so that it may no infringe on the privacy of the data subject. Therefore, the POPIA requires certain responsible parties to comply with the minimum requirements of the eight conditions of lawful processing. [4] If, the POPIA requires for a responsible party to adhere to the conditions, first what is the definition of a responsible party in terms of POPIA? POPIA defines a responsible party as ‘a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing information.’ [5]
An example of a responsible party could be a law firm. A law firm collects various amounts of personal data from its client, hereinafter referred to as a ‘data subject’, in order for the furtherance of the data subject’s instructions. It is necessary for a law firm to collect the correct information from the data subject to ensure the correct processing information to assist with providing proper advise to a data subject. Therefore, and inference can be drawn from the definition of the POPIA that the purpose of a law firm would qualify as responsible party and further, would be obligated to comply with the eight lawful conditions of processing POPIA.
b. What are the Eight Conditions of Lawful Processing of Personal Information and its Overarching Purpose as defined in the Protection of Personal Information Act 4 of 2013.
Chapter 3 of the POPIA addresses the conditions for lawful processing of personal information. The right conditions as set out within the POPIA are: 1) Accountability; 2) Processing limitation; 3) Purpose specification; 4) Further processing limitation; 5) Information quality; 6) Openness; 7) Security safegaurds; and 8) Data subject participation.
The conditions are intended to firstly, ensure that the conditions are met are lawful for any processing of personal data within the law [6] and secondly, on regard to the context of a data subject the conditions qualify the right a data subject has in terms of POPIA, which allows for the data subject to enforce compliance of the conditions against the responsible party, if the conditions for the lawful processing of personal information has been contravened.
The eight conditions will be briefly discussed and its intended purpose in terms of the POPIA.
(i) The first conditions of accountability imposes a duty of diligence upon the responsible party to ensure that the provisions of the POPIA are complied with from the beginning, during and after of the data collection process. Therefore, it should be noted that a data subject does not have a right to accountability, this is because Section 8, referring to accountability, is not expressly mentioned in terms of Section 5 of a data subject’s rights.
(ii) The second condition is processing limitation, which has four subsections of (i) lawfulness and reasonableness; (ii) minimality; (iii) consent, justification and objection; and (iv) direct collection. The overarching aspects of the four subsections is to highlight the limits to the processing of the personal data of data subject to ensure that such processing is done lawfully.
(iii) The third conditions is purpose specification is closely related to ‘specific and informed consent. There cannot be specific and informed consent if a responsible party cannot provide the data subject with expressly informed information about the processing of information and that the information should not be kept longer than its intended purpose.
(iv) Further processing limitation is the fifth condition; the responsible party may not further process the personal information of a data subject in a way that goes beyond the normal parameters for which it was initially collected.
(v) The sixth conditions is information quality therefore, information is required to be updated regularly and verified with the data subject periodically.
(vi) The security safegaurds are held in from Section 19 and Section 22 of POPIA, this requires the responsible party to have reasonable safegaurds internally and externally measures which relate to the integrity and confidentially of personal information. Reasonable measures includes risk assessments internally and externally of all reasonably foreseeable risk i.e. background checks on people dealing with data, security system of the building. If there is a breach of the security safegaurds then a data subject should be informed immediately either via mail, email or a media statement as reasonably possible and to the Information Regulator.
(vii) Data subject participation principle allows for the data subject to participate and have a measure of influence, the processing of data on them by other individuals or organizations. Furthermore, data subjects can request from the responsible part personal information at a required fee and a responsible party may refuse such information, if the Promotion of Access of Information 2 of 2000 (“PAIA”) provides ground of refusal.
With an understanding of the background of POPIA and the eight lawful processing conditions that are required to be complied with the responsible party’s what does this mean for South African business going forward?
SOUTH AFRICAN BUSINESS AND ITS READINESS FOR PROTECTIONS OF PERSONAL INFORMATION ACT 4 OF 2013
It should be noted that the POPIA is not fully operational as an Act and will commence at a later stage. However, the POPIA can provide a good guideline as to how the POPIA will operate once it fully comes into effect. However, once the POPIA becomes fully operational, business will need to understand the provision stipulated in the POPIA and be able to adapt these provisions to their businesses. This means that business must make adaptive changes and place measures on their employees, systems and technology. If business don’t comply with the provisions of the POPIA, the could be fined or a possible prison sentence.
Firstly, for South African business to be aware of their readiness three questions needs to be asked by the Information Regulator to the businesses; firstly, are companies aware of the POPIA? Secondly, have companies taken measures to comply with the provisions with POPIA? Thirdly, if businesses fail to comply with the provisions what effect will it have on their business?
What can be taken from the article by Kandeh is that there is a general awareness of the POPIA but the implementation varies due to the challenges and complexities of the POPIA. Therefore, some measures are taken but will not be enough once the Act becomes fully operational. A great point made is that each industry should create their own code of conduct or guidelines in relation to the POPIA so that all business can be compliant once the POPIA becomes fully operational in law. Furthermore, most businesses are reluctant to adopt the provisions of the POPIA into their day-to-day operations because until such a time the Act becomes operational, business see that full compliance as a distant concept, most business sees it as a financial burden to comply. The general consensus is that until the POPIA becomes fully operational, most businesses are not enthusiastic to employ full-sale implementation of the regulations and provisions of the POPIA as it might disrupt their operations.
CONCLUSION
The POPIA provides the data subjects rights which are afforded to them by provisions of the Act. This requires that a responsible party to lawfully process the data subject information in terms of the POPIA. If the responsible party breaches or fails to comply with the provisions, the could be fined and imprisoned by an order made by the Information Regulator. Therefore, if the POPIA requires responsible parties to comply with these provisions, are businesses in South Africa, that handle personal information of data subject, ready to implement the provisions and if not, what were the reasons of non-compliance.
There needs to be a greater awareness of the POPIA in terms of business and the consequences of noncompliance by parties. Furthermore, due to the fact that the POPIA is not fully operational, there is a lack of urgency of business to comply or begin to implement the provisions through their operations systems. The success of POPIA will occur through implementation of guidelines or codes of conduct on the processing of a personal information tailored to each industry. This will ensure that compliance is met timeously.
