POPI provides the regulatory framework within which organisations may process personal information and seek to give individuals control over how their personal information is used or disclosed.
The bill defines "personal information" as all information relating to an identifiable, living natural person and where applicable, an existing juristic person - all such persons being defined as "data subjects".
The definition of "processing" is drafted wide enough to cover any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including the collection, receipt, collation, storage, updating and use of the information.
In order for the processing of personal information to be lawful, it needs to comply with the following eight conditions:
The "responsible party" (being the party that determines the purpose of and means for processing) must ensure that the conditions for processing are complied with at all times.
Processing must be lawful, done in a reasonable manner that does not infringe the privacy of the data subject and must not be excessive. Processing may only take place with the consent of the data subject, subject to certain exceptions (such as is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party, it complies with an obligation placed on the responsible party by law or it protects a legitimate interest of the data subject). Personal information must be collected directly from the data subject to certain exceptions.
Collection must be for a specific purpose and records may not be kept for any longer than is necessary for achieving the purpose for which it was collected or subsequently processed, subject to certain exceptions (for example it is required or authorised by law or the data subject has consented).
Further processing must be compatible with purpose of collection taking into account, amongst others, the nature of the information, the consequences for the data subject and the manner in which the information was collected.
The responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and updated where necessary.
A responsible party must maintain documentation of all processing operations. When personal information is collected, the responsible party must (subject to exceptions) take reasonably practicable steps to ensure that the data subject is aware of, inter alia, the information being collected, the source, the purpose of the collection and the rights of the data subject.
Reasonable measures must be taken to identify all foreseeable internal and external risks, establish and maintain appropriate safeguards against these risks, regularly verify that the safeguards are effectively implemented and ensure they are continually updated. The responsible party must notify the Information Regulator and the data subject when the personal information of a data subject has been accessed or acquired by any unauthorised person.
The data subject has a right to request a responsible party to confirm whether or not it holds personal information about the data subject (free of charge), to request the record or a description of the personal information held, as well as the identity of third parties who have access to the information. The data subject also has the right to request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
In addition to the above eight conditions of processing, POPI also deals with:
The legislation will apply to both public and private bodies, including retirement funds and administrators. There will be a transitional period of one year whereafter full compliance with the legislation will be required.
Extracts taken from the Sanlam Employee Benefits Newsletter (Legal - August 2013)
