With July 1 around the corner, Shirley le Guern considers what the Protection of Personal Information Act (POPIA) will have on our lives.
Jotting down everything from your ID number to your cellphone details just to manoeuvre your way into your favourite coffee shop or access a residential estate is now the so-called new normal. But the big question has to be what happens to your details? What guarantees do you have that this highly valuable information won’t be sold on to direct marketers to bug you incessantly with the latest “deal” or, worse still, lead to identity fraud?
According to the Southern African Fraud Prevention Service (SAFPS), there was a massive 337% increase in identity fraud in 2020. This, says SAFPS chief executive, Manie van Schalkwyk, is not limited to the information you provide to pharmacies or restaurants, but also to the greater chance of cybercriminals breaching tentative home security systems used by those working remotely.
Hovering in the wings is the Protection of Personal Information Act (POPI or POPIA) which is expected to shut down telesales people who might have purchased your personal details. Enacted as far back as 2013, it is due to come into full force in July this year.
Ros Lake, director of law firm Norton Rose Fulbright, explains that POPIA sets out the minimum requirements for those processing personal information. “Processing includes storing, transferring, accessing, merging, destroying, deleting and anything else you can think of when it comes to using personal information. Personal information is also very broad. It includes health information, opinions, private correspondence, fingerprints, criminal history and any other information that can be used to identify someone.”
Ros warns that, when it comes to the information required to protect us from Covid, the right to privacy must be balanced against other rights such as the public interest and keeping people safe.
“However, these records should not be openly displayed; not be kept for longer than necessary; and not be used for anything other than the purpose for which they were collected. That means, if you give your details to a restaurant to be contacted for Covid, they shouldn’t use this information to contact you for direct marketing or add you to their databases,” she explains.
Compliance officer for Garlicke & Bousfield, Shannon Budhram, believes that, pandemic or not, consumers will benefit. “Consumers are informed about what personal information is collected, by whom and why, so that they can make informed decisions.”
Shannon adds that, in April 2020, the Information Regulator issued a Guidance Note on the processing of personal information for the management and containment of Covid-19. This not only outlined the limitations and the need to protect people’s right to privacy, but also addressed the provision of location-based data by electronic communication service providers to government to track data subjects during the management of Covid-19.
“In essence, the responsible party must always ensure that the spirit of the legislation is upheld even during a pandemic,” she says.
Shepstone & Wylie’s head of social media law, Verlie Oosthuizen, points out that it is only now that this deadline looms that many are realising the level of compliance that is required. But this is no excuse.
“The office of the Information Regulator is still relatively small at the moment and so extensive monitoring may be challenging. However, ignorance of the requirements will never be an excuse or a defence for non-compliance,” she says.
From July, POPIA will not only ensure that defaulters can face a fine or penalty for using your personal information without your permission, but that they can also be found civilly liable for damages.
That said, there’s no guarantee that those pesky calls will stop.
“Consumers should know that they always have the right to opt-out of being contacted and they should be allowed to do so for free. If you are contacted after you have told someone not to contact you, you can report them to the National Consumer Commission. In terms of POPIA, companies will only be able to contact people who are not on their existing customer list once to ask for their permission to receive marketing material,” says Ros.
POPIA will also not prevent identity theft.
“There are people and robots looking for all sorts of ways to get hold of your personal information. This information is then often sold on the dark web to criminals to impersonate you. Medical records are particularly valuable. Make sure you adhere to good cyber hygiene. Change your passwords often, check your privacy settings on social media, look at privacy policies of companies you deal with so you understand what they are doing with your information. Also, do not click on unknown links and watch out for phishing emails. Always check carefully to make sure the contact is legitimate,” says Ros.
The 8 Commandments of POPIA
Garlicke & Bousfield’s Shannon Budhram shares these eight commandments for business owners:
- Be accountable.
- Processing limitation – process information lawfully and not excessively.
- Purpose specification – process information for a lawful purpose.
- Further processing limitation – process information only for the purpose for which it has been collected and for no other purpose.
- Information quality – ensure personal information records are complete, accurate, not misleading and updated where necessary.
- Openness – be open about why you need the data subject’s personal information and how you intend to use and process it.
- Security safeguards – take appropriate, reasonable, technical and organisational measures to secure the integrity and confidentiality of the personal information you process and to prevent loss, damage or unauthorised destruction of personal information and unlawful access to or processing of the personal information.
- Data subject participation – the data subject has the right to request their personal information record be corrected or deleted, if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, or that the personal information or record be destroyed or deleted if the responsible party is no longer authorised to retain it.