21/07/2020
BEAT THE POPIA DEADLINE
21 July 2020
BY ANISHA JOGI
Director A Jogi Incorporated Attorneys
Data is now regarded as the new “gold” particularly as we become more submerged into the realm of the Fourth Industrial Revolution, Data Mining and Artificial Intelligence, technology that feeds on data. As a result, laws governing privacy and data protection are not only highly relevant but crucial to protecting clients and ultimately your organisation’s reputation. The Protection of Personal Information Act, commonly known as POPIA, is South Africa’s first data protection law intended to protect people’s personal information, to prevent their money being stolen, to stop their identity being stolen, and generally to protect their privacy, a fundamental human right enshrined in section 14 of our bill of rights.
President Cyril Ramaphosa finally announced that the commencement date of the Protection of Personal Information Act (no 4 of 2013) is 1 July 2020. With this pronouncement, the preponderance of the statute commences, such as its purpose, its application provisions, the conditions for lawful processing of information and exemptions, prior authorisation, a code of conduct. The deadline within which organisations are required to comply has now been postponed to 1 July 2021, possibly due to Covid-19.
POPIA involves three parties (who can be natural or juristic persons): The Data Subject (the person to whom the information relates); The Responsible Party or Controller (the person who determines why and how to process the information, such as, profit companies, non-profit companies, governments, state agencies and people; and The Operator or Processor (a person who processes personal information on behalf of the responsible party, such as, an IT vendor).
POPIA places various obligations on the Responsible party and lays out the conditions under which information can be lawfully processed. For example, the data subject must consent to their information being stored and how it can be processed, and they can demand for it to be obliterated. Given the great deal of accountability placed on the Responsible party, they should only use Operators or Processors that are able to meet the requirements of lawful personal information processing prescribed by POPIA. Non-compliance with POPIA carries severe penalties of up to R10m in fines or 10 years’ imprisonment, or both. In addition, organisations can find themselves being ordered by the regulator to pay compensation to the Data subject, and they can further be sued by affected parties for damages arising from matters such as theft of money and identity theft.
The question is what can organisations do in practical terms in order to abide by the law? Here are recommendations they can consider taking:
1. Identify the person in your organization that is responsible for information privacy, who will manage and oversee compliance with POPIA. This person would be the “Information Officer” and typically, for juristic entities this is the head of the organisation such as the chief executive officer or equivalent officer of the juristic person or any person duly authorised by that officer, or the person who is acting as such or any person duly authorised by such acting person.
2. Create a data privacy or security policy that sets the principles of action adopted or proposed by an organization on managing personal information within the organisation, who will have access to such information, and how it will be processed and stored. Such a policy could incorporate the eight POPIA principles: the responsible party taking accountability for information in their domain; limitations on processing information; using information for a specific purpose; limitations on the further processing of information; ensuring that information is correct, complete and up to date; openness about why information is collected; the safeguarding of information; and participation by the data subject.
3. Foster employee training and awareness about information privacy and security. Employees contracts should affirm that the employee will be committed to their responsibilities to safeguard privacy and security as enshrined in the organization’s policy. Review and amend the employment contracts of those employees who process information, so that they are in line with POPIA. The organisation ultimately remains accountable for data breaches and must be able to hold its staff accountable too.
4. Have processes in place deal with information that must be collected or shared and to report data breaches to all affected parties, including the Data Subject and the Information Regulator. The cost of cleaning up a data breach should also be taken into account, which can run into the millions for large organisations.
5. Establish a central data repository system where all information with which the organisation has been entrusted is stored, both internally and externally and ensure that they are subject to proper data privacy laws.
Compliance with POPIA should not be undermined and organisations of all sizes must review, assess and improve their current data security practices to mitigate risks. There is the long-term reputational damage and loss of confidence in an organisation following an information breach, which will almost certainly mean a huge knock to its bottom line. The news is rife with high-profile examples of data breaches worldwide. In the past year or two, major South African organizations such as, Liberty, Nedbank and the City of Johannesburg have been the victims of headline-grabbing data breaches. Further abroad, in February 2019, hotel chain MGM Resorts suffered a data breach in which more than 142 million personal details from former guests at the MGM Resorts hotels, including names, addresses, telephone numbers, e-mails and birthdays was stolen and placed for sale on the Dark Web evidence that a data leak. They included high-profile guests such as pop stars and senior US government officials guaranteeing extensive media coverage on the matter.
Given the reputational risk, much more rides on an organisation’s ability to secure the personal information of third parties, than the negligible penalties contained in POPIA. Organisations thus have every reason to ensure that their systems are secure. Those that are serious about data privacy will not be waiting around for 1 July 2021.