VRYHEID KZN: Educate yourself with the new act
The act refers to the ‘processing of personal information’ - this refers to acts such as the saving, working with, or re-working of personal information
Businesses and individuals across South Africa may face fines of up to R10 million if they are not fully compliant with the Protection of Personal Information Act (POPIA). This law will fully take effect on June 30, 2021. Because the act consists of technical jargon, millions of South Africans struggle to understand what it is that the act requires them to do. In this editorial piece, Caxton Local Media explains some basics regarding POPIA.
What is the purpose of POPIA?
To protect people by helping to prevent the misuse of their personal information.
What is personal information?
Personal information = information that relates to a person or entity.
What does this mean?
Personal information is a link that leads others to you. Your contact number links you to others. Through it, they can contact you. The same applies to your email address and other contact details. Your identity number is a reference that links others to you. Your motor vehicle has been registered in your name and, if someone should trace your car’s registration number, they will be led, once again, to you. Content featuring your details links back to you. Examples include medical records, financial information, personal or confidential information, and your name and surname. POPIA applies to most of us. We all need to ensure that we treat personal information lawfully and responsibly. Every business must have an official who takes responsibility for the implementation of POPIA. If you believe you may be exempted from POPIA’s application, discuss this with your attorney in order to obtain clarity.
Does POPIA apply retroactively?
No. If you collected someone’s personal information prior to the days of POPIA and if you still need it, you may lawfully have it. However, POPIA will affect how you deal with it going forward. POPIA also affects how you will collect and process personal information in future.
Protection of personal information in practice: Collecting personal information:
You may only collect personal information if you have the informed consent of the person or entity whose information you are collecting. The act refers to such a person as a ‘data subject’. The data subject must know what the collector seeks to do with his or her personal information, where it will be safely stored, and that they have the right to have it updated on the records of the collector. Data subjects must be informed of their right to demand their information be destroyed, and of their right to contact the responsible party’s information protection officer, and the Information Regulator, with queries or complaints. The Information Regulator can be reached online via https://www.justice.gov.za/inforeg/.
Protection of personal information in practice: Using personal information:
The act refers to the ‘processing of personal information’ – this refers to acts such as the saving, working with, or re-working of personal information. One should only ever use the minimum amount of personal information required to achieve the purpose communicated to a data subject. Government has made more information available on www.popia.co.za, where chapter 3 of the act elaborates on using personal information.
Knowledge is power:
As with all things, the best way to become POPIA compliant is to ensure that you have a thorough understanding of the act and its requirements.
Compiled by Helene Viljoen (Caxton Local Media Legal Advisor)
ALSO READ: POPIA, your business, third-party engagements and privacy laws relation explained
Make sure you follow us on our social media platforms for regular updates
