PRIVACY

Personal information no longer a tradable commodity

The advent of the digital era has necessitated further development of the law to take into account new challenges faced by individuals with regard to personal information. Kamalesh Naidoo explains the finer points of the Protection of Personal information act

Questions? kamalesh.naidoo@hotmail.com

Privacy has long been regarded as an independent personal right in terms of the common law.¹ The Constitution of the Republic of South Africa now enshrines this right in terms of section 14 of the Bill of Rights.² While the right to privacy is not absolute and may be limited, the courts tread carefully when it comes to the ‘inner sanctum’ of a person.

The call for greater protection of personal information is not something that is unique to South Africa. But in the digital world, whether it’s digital cameras or satellites or just what you click on, we need to have more explicit rules – not just for governments but for private companies as well.”

According to the South African Law Reform Commission (SALRC) report³, “the first data protection laws were enacted in the 1970s”4 and there has since been a steady rise in the number of countries enacting data protection laws.

Pursuant to recommendations made by the SALRC5 to fill the holes that existed in our law, the Protection of Personal Information Act (POPI) was signed into law by the President on 19 November 2013. As of 11 April 2014, sections of the Act have been brought into effect. This allows for the establishment of the Information Regulator, a statutory body empowered to, inter alia, monitor and enforce compliance with the act6 .

The act frequently makes reference to two key terms – ‘data subject’ and ‘responsible party’. A ‘data subject’ is the person to whom personal information relates – ‘person’ being either a natural person (human being) or juristic person (a corporate entity such as a company or close corporation). A ‘responsible party’ means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.7

The purpose of the act is to “give effect to the constitutional right to privacy, by safeguarding personal information when processed by a responsible party, subject to justifiable limitations”.8 The act also aims to:9 • Provide persons with rights and remedies to protect their personal information from processing that is not in accordance with the act; • Regulate the manner in which personal information may be processed, by establishing conditions in line with international standards and which prescribe the minimum threshold requirements for the processing of such personal information; and • Rstablish an ‘information regulator’ to promote, enforce and fulfil the rights protected by this act.

The act applies to the ‘processing of personal information’. This casts a particularly wide net as the terms ‘processing’ and ‘personal information’ are broadly defined terms in the act. Personal information

1 Currie and de Waal. Bill of Rights handbook. 2005. Juta: Cape Town. P316 2 act 108 of 1996 3 discussion paper 109 published in october 2005. 4 ibid at p373. 5 in discussion paper 109 published in october 2005. 6 By proclamation in the Government Gazette. Regulation 25 published in GG 37544 on 11 april 2014. sections 39 and 40 of the act. 7 section 1 of the act. 8 section 2 of the act. 9 ibid.

015 516 5350 masana@polka.co.za 58 Munnik Street 63 Kruger Street Louis Trichardt 0920

Mr N.P Muladi, CEO of Masana Social Consultants, established his business in 2002 after serving the ANC for almost 20 years as a Municipal Mayor at Makhado Municipality and as a District Councillor at the Vhembe District Municipality. During his time a Councillor he recognized the need for skills development especially in previously disadvantaged communities, so he made it his mission to empower people with LIC (Labour Intensive Construction) skills training. Masana Social Consultants have helped train many people through skills developments in the fields of Building and Civil Engineering - leading to good working relationship with the Vhembe FET College,Lephalale FET College, CETA , Thulamela Municipality, Makhado Municipality , Mutale Municipality, Musina Municipality, Vhembe District Municipality and Local Contractors. Masana have been involved throughout the implementation of EPWP and CWP by offering their services through skills training, monitoring and project management.Masana, a multi-purpose institution, has assisted the country’s economy by job creation through youth development by engaging the youth in Apprenticeship, Internships, Learnership, and RPL (Recognition of prior learning).Masana also manufactures LBS cold mix Asphalt and by doing this they employ learners who are doing learnership on Construction Roadworks NQF level 3, ensuring that the learners have an exit strategy and that they can put their newly learnt skills into pratice. Masana believes strongly in social responsibility and showed it by dontating four RDP standard houses to disadvantaged families and by donating skills trainings to those who cannot afford to pay.

We offer the following services: Long Duration courses: Project Management NQF Level 2(CC2) | Supervision of civil engineering NQF Level 4 | Construction Roadwork’s NQF Level 1-3 | Community House Building Construction NQF Level 2 |Community House Building NQF Level 2, Building & Civil Construction NQF Level 3

Short Duration Courses: Occupational Health& Safety NQF Level 2 (OHS) | Basic First Aid NQF Level 1-2 | Basic Fire Fighting NQF Level 2 | Welding/ Boiler Maker | Painting | Carpentry | Bricklaying | Plumbing | Roofing | How to start and run your own business | Business finances | Demonstrate and Understand Entrepreneurship | Computer Literacy | Mining Drilling | Mining Chainsaw | Solar and Geyser installation | Plant operator NQF Level 3

Ntsudeni Phineas Muladi (CEO) Nicholas Tendani Muladi (Managing Director) Sophie Mashudu Munyai (Admin Manager)

is regarded as being information relating to an identifiable, living, natural person (human being) or where applicable a juristic person (a company or close corporation) – which includes but is not limited to: • Biometric information (eg. blood type); • Personal opinions, views or preferences; • Correspondence sent which is of a private or confidential nature; • Any identifying number, symbol, email address, physical address, telephone number of the person; • The race, gender, sex, pregnancy, marital status and national, ethnic or social origin of the person; • Sexual orientation, age, religion of the person; • Education, medical, financial, criminal history or employment of the person.

Processing is defined as ‘any operation or activity or set of operations, whether or not by automatic means, concerning personal information’, which includes:10 • The distribution of personal information, or • The collection, recording, storage, updating or modification of personal information.

If you collect, supply or store personal information, you are processing personal information. The act, however, does not apply to:11 • Personal or household activities; • Personal information that is deidentified, which cannot be reidentified; • Cabinet and provincial executives; • Judicial functions performed by courts of law; • Artistic, journalistic or literary purposes.

The act provides the following conditions12 for the lawful processing of personal information: • Accountability – the responsible party must ensure that measures are taken that give effect to the act. • Processing limitation – personal information must be processed lawfully and in a reasonable manner. • Purpose specification – the personal information must be collected for a specific, explicitly defined and lawful purpose. • Further processing limitation – further processing of personal information must be compatible with the purpose for which it was collected. • Information quality – a responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and up to date where necessary. • Openness – a responsible party must maintain the documentation for all processing operations under its responsibility as per the act. • Security safeguards – a responsible party must secure the integrity of the personal information and take appropriate technical and organisational measures in order to do so.

The act provides that personal information may only be processed where:13 • Consent14 has been obtained; • It is necessary to carry out actions for the performance of a contract to which the data subject is a party; • Processing protects a legitimate interest of the data subject; • Processing is necessary for the proper performance of a public law duty by a public body; or • Processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

The act states personal information must be collected for a specific purpose.15 A responsible party must take steps to ensure the subject knows:16 • The information being collected; • The purpose for which the information is being collected; • The name and address of the responsible party; • Any particular law authorising or requiring the collection of information.

Furthermore, the act demands 'personal information be collected from the data subject' unless:17 • The information is derived from a public record or has deliberately been made public by the data subject; or • The data subject has consented to the collection of information from another source; or • Collection of information from another source would not prejudice a legitimate interest of the data subject.

The implications of the act are farreaching and will affect the way business is conducted. Businesses must adopt a proactive approach and timeously undertake risk analysis and compliance measures rather than a reactive approach to the act.

To mitigate potential risks, businesses should: • Try to minimise scenarios where there are multiple sources of personal information (especially where the information is stored in an unsecured manner). • Try to minimise the retention of paper-based documents where information is electronically captured and retained. • Establish safeguards for the storage of personal information retained in hard copy (eg. storage of files in a locked cupboard). • Include clauses in employment contracts where the employee consents to the collection and storage of personal information by the employer. • Identify and delete personal information that is no longer required. • Include clauses in contracts of sale allowing for the processing of personal information.

10 Section 1 of the Act. 11 Section 6 of the Act. 12 Section 4 of the Act. 13 Section 11 of the Act. 14 Based on the definition of consent contained in the Act it would appear that written consent does not appear to be a requirement but rather some positive act which grants consent. 15 Section 13 of the Act. 16 Section 18 of the Act. 17 Section 12 of the Act.

JOIN NOW AND ACCESS OVER 300 PROCUREMENT OPPORTUNITIES A DAY FOR ONLY R500 PER YEAR

OPENTENDERS is a valuable, effi cient and cost effective service for identifying tenders from all levels of government and private business. Over 300 new tenders are sourced, collected and listed on a daily basis.

Have a project or a purchase order and need funding?

We also facilitate project funding for tenders, contracts and purchase orders.

Features include:

• Free Business-to-Business Social network where you can network with other business owners and promote your company. • Instant tender and RFQs notifi cations via email • Subscribe to unlimited tender categories • 24/7 access to search for tenders online • Easy access to supplier database registration forms for government departments • Facilitation of project fi nance for tenders and purchase orders • Exclusive access to members only events, seminars and online videos

FOR A LIMITED TIME WE ARE RUNNING A SUBSCRIPTION FEE SPECIAL OF ONLY R500 YEAR. (THE SERVICE NORMALLY COSTS R2000)

HOW TO SUBSCRIBE TO OPENTENDERS:

Online: Log onto www.opentenders.co.za By phone: 011 050 0977 By Email: Send you details to info@opentenders.co.za