Protection of Personal Information Act becomes effective
On Monday, 22 June 2020, the Presidency announced the commencement of substantial sections of POPIA, which will come into effect on 1 July 2020. The relevant sections are sections 2 to 38, sections 55 to 109, section 111 and section 114(1), (2) and (3).
The sections brought into effect place obligations on all persons or companies that receive and process personal information in respect of any other person and determine how it is to be collected, stored, used, disseminated or destroyed.
Section 2 to 38 set out the substantive rights and obligations created by POPIA and include:
The circumstances in which POPIA applies and the persons affected by it;
The eight conditions for processing of personal information. These conditions include: the accountability of persons and entities processing information (“responsible parties”), limitations on processing, specification of the purpose of the processing, limitations on “further processing” (i.e. processing for a purpose other than the purpose for which the information was originally collected), completeness and correctness of information, transparency in regard to information and its processing, security safeguards and the rights of data subjects to obtain details of information processed and correct inaccuracies;
Provisions for the processing of “special personal information” (information of an intensely personal nature, such as information in relation to a person’s health, sexual behaviour, religious and political beliefs), information relating to children; and
Exemptions from having to comply with the conditions.
Sections 55 to 109 deal with:
The appointment of information officers by responsible parties;
When prior authorisation to process data is required from the Regulator;
The issuing of codes of conduct by the Regulator, in respect of specific industries, classes of information, etc.;
Rights of data subjects regarding direct marketing by means of unsolicited electronic communications, directories and automated decision making;
Trans-border information flows; and
Enforcement procedures, offences, penalties and administrative fines.
The coming into operation of section 114(1) is important for both private and public bodies to bear in mind as the section states that all forms of processing of personal information must, within one year after the commencement of the section, be made to conform to POPI. Therefore, all persons, companies and public institutions will be required to ensure that the manner in which they process information is compliant with POPI by 1 July 2021 at the very latest.
For more information and advice on navigating these issues, please contact us.