Menu

Privacy

Insights-Artwork-min

Data protection for civil society: A guide to the Protection of Personal Information Act

, , , ,

  • The Protection of Personal Information Act (POPIA) will have implications for all sectors across South Africa, including civil society organisations.
  • There are certain provisions of POPIA that are likely to be of particular interest or relevance to organisations working on public interest issues and fundamental rights.
  • Civil society organisations are also well-placed to raise awareness about the role and importance of data protection and to support individuals to realise their privacy rights and hold wrongdoers to account.

Introduction

The Protection of Personal Information Act 4 of 2013 (POPIA) will have implications for all sectors across South Africa once the remaining provisions come into force.  Enacted to give effect to the constitutional right to privacy, it also provides a framework for striking a balance between privacy and the protection of other important interests, including the free flow of information within South Africa and across international borders.

POPIA applies to personal information entered into a record – through either automated or non-automated means – where the responsible party is either domiciled in South Africa or makes use of means in the country.  Subject to the exclusions set out in sections 6 and 7 of POPIA, the law applies to all processing of personal information by both the state and private sector.

This includes civil society organisations (CSOs), which will also be required to comply with the provisions of POPIA.  Among these requirements are eight conditions for lawful processing of personal information; limitations on cross-border data transfers and processing for direct marketing; and the realisation of data subject rights.  (An overview of POPIA is accessible here.)

CSOs should take care to ensure reasonable and responsible data processing, particularly by limiting the amount of personal information that is collected.  At this stage, there is no special dispensation for CSOs, which means that CSOs will need to prepare for compliance with the legislation as a whole.  However, our experience having worked in and on behalf of civil society has given us insight into certain aspects of POPIA that are likely to be of particular interest or relevance to CSOs.  These aspects are highlighted below.

Exemptions in the public interest

As a point of departure, and of direct applicability to CSOs, section 37 of POPIA provides that the Information Regulator may grant an exemption from complying with POPIA, provided that one or both of the following requirements are met: (i) the Regulator is satisfied that the public interest in processing outweighs, to a substantial degree, any interference with the privacy of the data subject that could result from the processing; or (ii) that the processing involves a clear benefit to the data subject or third party that outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from the processing.

The public interest includes, in this context, the interests of national security; the prevention, detection and prosecution of offences; important economic and financial interests of a public body; historical, statistical or research activity; or the special importance of freedom of expression.

Given that the requirements under POPIA are certainly onerous, and compliance may be a resource-intensive exercise, CSOs may consider applying to the Information Regulator for an exemption in respect of certain processing activities.  For instance, CSOs with a focus on historical, statistical or research activities will likely have a strong basis to argue that such an exemption should be granted in the public interest.  Furthermore, although the provision only expressly refers to the right to freedom of expression, it may be argued that the pursuance of any constitutional rights – such as health, education or housing – would similarly be in the public interest, and therefore subject to a possible exemption being granted.

Even if the Information Regulator were to impose conditions on such an exemption, it can be expected that this would still assist in reducing the compliance burden.  Similarly-placed CSOs may consider approaching the Information Regulator jointly to secure an exemption that has broad application to the public interest sector.

Grounds for lawful processing

Section 11(1) of POPIA sets out the grounds on which personal information may be processed.  Consent is one such ground, where the data subject has consented to their personal information being processed.  In order for consent to be valid, it must be voluntary, specific and informed.

CSOs should take care to ensure that the consent obtained is meaningful, and that the data subject has retained agency in determining how their personal information is to be used.  As explained in recital 32 to the General Data Protection Regulation (GDPR) of the European Union, consent should be given by a clear affirmative act:

This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data.  Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

If a CSO chooses to rely on consent as the ground for the processing of personal information, that CSO should ensure that it is able to prove that the data subject has provided the appropriate consent.  Further, it is also necessary to ensure that the data subject to able to withdraw consent and to have the processing consequently stopped.  According to the Information Commissioner’s Office in the United Kingdom, consent is not valid if any of the following apply:

  • you have any doubts over whether someone has consented;
  • the individual doesn’t realise they have consented;
  • you don’t have clear records to demonstrate they consented;
  • there was no genuine free choice over whether to opt-in;
  • the individual would be penalised for refusing consent;
  • there is a clear imbalance of power between you and the individual;
  • consent was a precondition of a service, but the processing is not necessary for that service;
  • the consent was bundled up with other terms and conditions;
  • the consent request was vague or unclear;
  • you use pre-ticked opt-in boxes or other methods of default consent;
  • your organisation was not specifically named;
  • you did not tell people about their right to withdraw consent;
  • people cannot easily withdraw consent; or
  • your purposes or activities have evolved beyond the original consent.

Meaningful consent is perhaps not the silver bullet that some would like to believe.  In practical terms for CSOs, who may be based a distance away from the clients or partners with whom they are working – and which may further be exacerbated by barriers such as language and access to technology – it is not always simple or practicable to obtain meaningful consent.  It is therefore important to note that consent is not the only ground for lawful processing.

Another ground that may be relied on is where the processing is in the legitimate interests of the data subject.  While section 26 of POPIA makes clear that this ground does not apply to the processing of special personal information, it does nevertheless apply to the other types of personal information, such as names and contact details.  POPIA does not set out what factors should be taken into account when determining the legitimate interests, but it is certainly arguable that seeking to vindicate the fundamental rights of the data subject would meet these criteria.

While any of the grounds set out in section 11(1) of POPIA may be relied on in the appropriate circumstances, it bears mention that, to the extent possible, CSOs may want to consider both obtaining consent and establishing another ground of lawful processing, to ensure that the processing of the personal information is fully compliant with the will and interests of the data subject.

Special personal information

POPIA creates a sub-category of personal information – referred to as “special personal information” – which is afforded additional protections in terms of the legislation, given the sensitive nature of this information.  As set out in section 26 of POPIA, this includes religious or philosophical beliefs, race or ethnic origin, political persuasion, and information regarding one’s health or sex life.

As a general principle, the processing of special personal information is not permitted unless one or more of the exceptions apply.  The exceptions provided in respect of special personal information are much narrower than ordinarily applies, and for instance, does not include the legitimate interests of the data subject as one of the grounds on which processing is permissible.  Grounds that can, however, be relied on include consent from the data subject, or where the information has deliberately been made public by the data subject.

This provision is relevant given that various CSOs deal directly with matters pertaining to special personal information, such as the right to health, freedom of religion or racial discrimination.  For these organisations, the processing of special personal information is both necessary and unavoidable, which will, therefore, require appropriate measures to be put in place to ensure compliance with POPIA.  On the other hand, for those CSOs that do not deal directly with these issues, it may be advisable to endeavour to process as little special personal information as possible, given the more stringent requirements that apply.

Children

Sections 34-35 of POPIA put in place special protections for the processing of personal information of children.  As with special personal information, it would be advisable to limit such processing to the extent possible given the heightened protections that apply.

As a general principle, POPIA contemplates that the processing of personal information of children is not permissible unless one or more of the exceptions apply.  These exceptions include the prior consent of a competent person, or where the personal information has deliberately been made public by the child with the consent of a competent person.

For any CSO that processes personal information of children as a key part of its work, section 35(2) of POPIA may be helpful.  This provides for an application to be made to the Information Regulator for authorisation to process personal information of children, as long as this is in the public interest and appropriate safeguards are in place to protect the information.  CSOs working on children’s rights, for example, certainly have a strong basis to apply for this authorisation.  The Information Regulator is empowered to impose reasonable conditions if this authorisation is granted.

Cross-border data transfers

Many CSOs work with partners, donors and other stakeholders based outside of South Africa.  In such instances, where personal information will be transferred to third parties in another country, it is necessary to comply with the cross-border transfer provisions contained in section 72 of POPIA.  In sum, section 72(1) provides a general principle that personal information about a data subject may not be transferred to a third party in a foreign country unless one of the exceptions apply.

Two of the grounds of exception that may be expected to be commonly relied on are where the data subject consents to the transfer of personal information; or where the third party is subject to a law or binding agreement that provides an adequate level of protection substantially similar to POPIA.  Provision is also made for a cross-border transfer that is for the benefit of the data subject, where it is not reasonably practicable to obtain the consent of the data subject and the data subject would be likely to consent.

In the event of either special personal information, or any personal information about children, being transferred to a third party in a country that does not provide an adequate level of protection, section 57(1) of POPIA requires prior authorisation to be obtained from the Information Regulator before the transfer takes place.

Fundraising

Section 69 of POPIA deals with direct marketing through unsolicited electronic means.  Direct marketing includes any approach to a data subject – whether in person, by mail or electronic communication – to request the data subject “to make a donation of any kind for any reason”.  This has the potential to impact the fundraising efforts of CSOs that seek donations to support the work being done.  POPIA makes clear that data subjects have an express a right to object to the processing of personal information for direct marketing at any time.

As a general principle, such processing is prohibited unless the data subject has given consent to the processing or is a “customer” of the organisation.  In respect of the former, the Regulations in terms of POPIA (the Regulations), published in December 2018, provide that consent for the processing of personal information for direct marketing by electronic communications must be obtained in writing and in accordance with Form 4 contained in the Regulations.

Furthermore, in respect of the latter, for instance, when engaging with a former donor, the CSO must ensure that the data subject has a reasonable opportunity to object to the marketing, free of charge and without unnecessary formality.  In order to facilitate this, any communication for the purpose of direct marketing must contain the relevant contact details for the recipient to be able to request the CSO to stop sending such communications.

When engaging with existing or potential donors, it would be advisable for CSOs to maintain a written record of the persons who may be approached and the basis on which it appropriate to make such an approach (for instance, if consent has been obtained).  It would also be advisable for CSOs to keep a record of those persons who have objected to receiving marketing communications, to ensure that the organisation does not inadvertently continue to send them communications in breach of these provisions.

Exclusions in terms of POPIA

Sections 6 and 7 of POPIA provide for certain exclusions to which POPIA will not apply.  This includes information that has been de-identified to the extent that it cannot be re-identified or the processing of personal information relating to the judicial functions of a court.

Further, section 7 of POPIA contains a specific exclusion for journalistic, literary or artistic expression.  In this regard, POPIA does not apply to the processing of personal information solely for the purpose of journalistic, literary or artistic expression, to the extent that it is necessary to reconcile, as a matter of public interest, the right to privacy with the right to freedom of expression.  As such, in order to rely on this exclusion, the following requirements must be met: (i) the processing is solely for the purpose of journalistic, literary or artistic expression; (ii) it pertains to a matter of public interest; and (iii) it is necessary to reconcile the right to privacy with the right to freedom of expression.

Should an exclusion apply to any processing of personal information, CSOs will not be required to comply with POPIA for the purposes of that exclusion.  However, until such time as further guidance is given, it would not be advisable to adopt too broad an interpretation of these exclusions, to avoid the risk of falling foul of POPIA.

Exceptions for historical, research or statistical purposes

POPIA contemplates that where personal information is processed for historical, research or statistical purposes, it is possible to be exempted from having to comply with certain conditions in the legislation.  For instance, POPIA provides that the personal information may be retained for a longer period than would ordinarily be permitted, and that notification to the data subject is not required as it would be in the ordinary course.  In respect of personal information of children, this exception only applies if it is in the public interest or would constitute a disproportionate effort to obtain consent, and appropriate safeguards are established over the personal information.

This exception is useful for CSOs undertaking research or that maintain archives of information.  It should, however, be noted that this exception is not a complete exclusion under POPIA; rather, there are still certain conditions that would need to be complied with, such as the requirement to maintain appropriate security safeguards over the personal information.  To the extent practicable, CSOs may consider de-identifying the personal information being used for historical, research or statistical purposes, to offer more complete protection to the data subjects to whom the information pertains.

Use of third party operators

Many CSOs are likely to outsource certain functions to third party operators to provide support and capacity to the organisation.  This may include, for instance, external service providers that perform the accounting and auditing functions, facilitate payroll, manage the pension fund, or provide monitoring and evaluation services.  Many of these functions will require the organisation to share personal information about its staff, clients and others with the third party operator in order for this function to be effectively completed.

Section 20 of POPIA provides that where an operator processes personal information on behalf of the organisation, the operator must treat the personal information as confidential and not disclose it unless required by law or in the course of their duties.  In the event of there being a data breach, the operator is required to notify the organisation immediately where there are grounds to believe that personal information has been accessed or acquired by an unauthorised person.

Of particular importance, CSOs engaging the services of third party operators must ensure that they have a written contract in place with the operator, requiring the operator to take appropriate, reasonable technical and organisational measures to prevent a data breach.  This contract should also require that the operator, among other things, ensures that its safeguards are continually updated and that it has due regard to generally accepted information security practices and procedures.

In addition to the written contract, it would also be good practice for the CSO to exercise a reasonable measure of due diligence over whether the operator is appropriately implementing this contract, and taking the necessary steps to protect the personal information that it has under its control.  Ultimately, in the event of a data breach, it will remain the responsibility of the CSO to notify the Information Regulator and the affected data subjects; it is also the CSO that faces the risk of reputational harm if appropriate measures have not been taken.

Concluding remarks

Data protection should not be seen simply as a compliance issue, but also as a public interest issue that is provided for in a framework that seeks to give effect to a range of constitutional rights, including privacy, freedom of expression and access to information.  Given that personal information is inherent to who are as people, this is certainly an aspect worth protecting.

There is, therefore, an urgent need for the remaining provisions of POPIA to be brought into force to ensure that the substantive protections of the legislation are implemented. Once in force, CSOs would be well-placed to use their voices to raise awareness about the role and importance of data protection, as well as to support data subjects in realising their rights and holding wrongdoers to account.

Avani Singh is a Director and Co-founder of ALT Advisory. Avani writes in her personal capacity and her views do not necessarily constitute the views of ALT Advisory.  This Insight is based on a workshop hosted by ALT Advisory on 20 August 2019, in which Avani presented to civil society organisations on data protection compliance in South Africa.

Please note: The information contained in this note is for general guidance on matters of interest, and does not constitute legal advice. For any enquiries, please contact us at [email protected].

5-min

Is POPIA-compliance sufficient to meet the requirements of the GDPR?

, , , ,

  • The General Data Protection Regulation of the European Union 2016/679 (GDPR) comes into force on 25 May 2018 and will apply extra-territorially to businesses located outside of the EU, for instance where such businesses offer goods or services to data subjects within the EU.
  • For South African businesses that fall within the extra-territorial scope of the GDPR, this means that they will need to comply with both the GDPR and South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).
  • While there is significant overlap between the GDPR and POPIA, the GDPR contains certain additional requirements above that required by POPIA which will need to be implemented by such businesses to ensure full compliance.
  • As discussed in more detail below, these additional requirements include, for instance, stricter conditions for valid consent; additional data subject rights pertaining to ‘the right to be forgotten’ and data portability; more stringent stipulations in the event of a data breach; the requirement that data protection impact assessments be conducted; and an obligation to implement appropriate technical and organisational measures that inculcate privacy by design and by default into the organisation.

Extra-territorial application of the General Data Protection of the European Union

In precisely a month from today, a new data protection law will take effect in the European Union (EU): the General Data Protection Regulation of the EU 2016/679 (GDPR).  (An overview of the GDPR is accessible here.)  The GDPR comes into force on 25 May 2018 and will replace the current EU Data Protection Directive 95/46/EC (EU Directive).

A particularly noteworthy feature of the GDPR is that it applies extra-territorially.  This means that it is not limited in its scope to businesses that are based in the EU; rather, it may also apply to businesses located outside of the EU.  In such instances, those businesses will be required to comply with the GDPR, despite not being located within the EU.  This is aimed at protecting the rights of EU data subjects, regardless of where and by whom their personal information is being processed.

In terms of article 3 of the GDPR, there are three instances in which the GDPR will apply extraterritorially.

The first instance is where a business located outside of the EU offers goods or services to data subjects within the EU.  In determining whether this provision applies, Recital 23 to the GDPR explains that the question to be determined is whether it is apparent that the data controller or processor intends or envisages offering goods or services to data subjects in one or more EU member states.  Simply put, it is a question of intention.

In this regard, the mere accessibility of a website or contact details are insufficient to ascertain such intention.  On the other hand, however, factors such as the use of a language or a currency generally used in a member state with the possibility of ordering goods and services in that language, or the mention of customers or users who are in the EU, may be sufficient to trigger the extra-territorial scope of the GDPR.

The second instance is where a business located outside of the EU monitors the behaviour of data subjects within the EU.  As explained in Recital 24 to the GDPR, this refers to the tracking of natural persons on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to make decisions concerning the data subject or to analyse or predict the data subject’s preferences, behaviours and attitudes.

The third instance is where the law of an EU member state applies to a controller located outside of the EU by virtue of public international law.  As explained in Recital 25 to the GDPR, this applies for instance to a controller in a member state’s diplomatic mission or consular post.

While the intention behind the extra-territorial application of the GDPR is rooted in wanting to protect the rights of EU data subjects, this can have onerous consequences for implicated businesses located outside of the EU that may be required to comply both with their own domestic data protection law and with the GDPR.

What does this mean for South African businesses?

South Africa too has a comprehensive data protection law: the Protection of Personal Information Act 4 of 2013 (POPIA).  (An overview of POPIA is accessible here.)  However, only certain sections of POPIA are currently in force: section 1 relating to the definitions; part A of chapter 5 relating to the Information Regulator; section 112 relating to the power to make regulations; and section 113 relating to the procedure for making regulations.  There is not yet a clear indication of when the remaining substantive provisions of POPIA regarding the conditions for the lawful processing of personal information will take effect.

Although compliance is not yet required in terms of POPIA, many businesses in South Africa have nevertheless proactively started taking steps to meet the requirements of POPIA in anticipation of the law coming into effect.  This will need to be expedited for those businesses falling within the extra-territorial scope of the GDPR, as they will already need to comply with the GDPR from 25 May 2018 onwards, even though POPIA is not yet fully in force.

POPIA was largely modelled on the EU Directive that will be replaced by the GDPR.  As such, whilst there is substantial overlap, the GDPR imposes certain additional requirements that were not contained in the EU Directive, and that are not required under POPIA.  Accordingly, for those South African businesses that do fall within the extra-territorial scope of the GDPR, complying with POPIA alone will not be sufficient to meet the requirements of the GDPR.

Set out below are some of the key requirements contained in the GDPR that are not expressly required in terms of POPIA:

  • Consent (article 7 of the GDPR): Consent is often relied on to facilitate the processing of personal information. Under POPIA, consent means “any voluntary, specific and informed the expression of will in terms of which permission is given for the processing of personal information”.  Under the GDPR, the conditions for valid consent are stricter.  The GDPR requires that a request for written consent “must be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language”.
  • Right to be forgotten (article 17 of the GDPR): While both POPIA and the GDPR contain a right to erasure, the GDPR goes further in defining what is commonly referred to as ‘the right to be forgotten’. The GDPR expressly requires that where a data controller has made personal information public and is obliged to erase that data, the data controller has a duty to take reasonable steps to inform other controllers processing that information that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, the information in question.  This right is, however, circumscribed by considerations of available technology and the cost of implementation, as well as the need to balance it with competing rights and interests, such as the right to freedom of expression.
  • Right to data portability (article 20 of the GDPR): The GDPR introduces a new right in respect of data portability, which relates to the right for a data subject to receive the personal information that they have provided in a structured, commonly used and machine-readable format, and the data subject’s right to transmit that information to another data controller. In short, this means that a data subject can require that their personal information is transferred from one data controller to another, where technically feasible.  This is aimed at ensuring that data subjects have more control over their data where processing is carried out by automated means.  POPIA does not include an express right to data portability.
  • Breach notification (article 33 of the GDPR): POPIA requires that in the event of a data breach, the party responsible must notify the Information Regulator and the affected data subjects “as soon as reasonably possible”. In comparison, the GDPR sets out more specific requirements, most notably that data breaches must be reported to a supervisory authority within 72 hours of becoming aware of the data breach unless the data breach is unlikely to result in a risk to the rights and freedoms of natural persons.  The GDPR also stipulates the specific information that must be provided in the notification to the supervisory authority.
  • Data protection impact assessments (Article 35 of the GDPR): The GDPR creates an obligation for data protection impact assessments to be conducted, and requires that the evidence or documentation of such assessments be maintained. This obligation arises where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons.  Recital 90 explains that impact assessments should include, in particular, the measures, safeguards and mechanisms in place to mitigate risk and demonstrate compliance with the GDPR.  Where appropriate, the GDPR requires that the data controller must seek the views of the data subjects or their representatives on the intended processing.  POPIA, on the other hand, does not expressly require that data protection impact assessments be conducted in the same vein.
  • Data protection by design and by default (article 25 of the GDPR): The GDPR further includes an express requirement that appropriate technical and organisational measures be implemented, both when determining the means for processing and at the time of the processing itself, that are designed to implement data protection principles in an effective manner. This includes integrating necessary safeguards and protecting the rights of data subjects.  The GDPR provides further that data controllers must ensure that, by default, only personal information that is necessary for the specific purpose is processed.  Data protection by design and by default is not expressly provided for under POPIA.

Concluding remarks

South African businesses that fall within the extraterritorial scope of the GDPR – that is, by offering goods or services to data subjects in the EU, or by monitoring the behaviour of data subjects in the EU – will carefully need to scrutinise both POPIA and the GDPR to be in full data protection compliance.  While complying with POPIA will mean that businesses are mostly compliant with the GDPR, there are certain additional requirements that will need to be met in order to fully comply with the GDPR.  This will need to be implemented from 25 May 2018 when the GDPR takes effect.

Although the additional requirements set out above may not expressly be required under POPIA, they are nevertheless a reflection of good practice.  Data protection by design and by default, for instance, contemplate measures specifically geared towards ensuring that the protection of data subject rights and the implementation of necessary safeguards features throughout the data processing lifespan.  This is similarly true of data protection impact assessments.  Although businesses may not be required by POPIA to implement these features in respect of their South African operations, it may, in any event, be worthwhile to voluntarily do so to ensure good practices and responsible data management throughout the organisation.

Avani Singh is a Director and Co-founder of ALT Advisory.

Please note: The information contained in this note is for general guidance on matters of interest, and does not constitute legal advice.  For any enquiries, please contact us at [email protected].

Skip to content