POPIA

• POPIA, which stands for the Protection of Personal Information Act protects individual privacy, a fundamental human right, defining personal information (PI) as data identifying individuals like name, gender, address, or health details.
• South Africa recognizes privacy as an integral human need though common law, South African Constitution section 14, and the Protection of Personal Information Act, 4 of 2013
• Certain sections of POPIA were enacted in 2014, while the remaining sections came into force in 2020, section 114 of POPIA provides a grace period of 1 year to ensure full compliance.
• POPIA balances the right to privacy with access to information, considering technological advancements and harmonizing South African law with international standards to ease data transfer.

Understanding the Terminology

• PI is any information revealing a person's identity, such as their name or ID number.
• Processing of PI broadly covers operations/activities like collection, receipt, recording, storage, updating, or modification.
• Collection gets PI for a purpose.
• Use accomplishes a task with PI.
• Storage saves PI on computer/filing systems for later use.
• Distribution shares PI with recipients.
• Destruction removes/destroys PI.
• Record includes writings, recordings, or stored information via computers, tape recorders, labels, markings, or writing identifying/describing part of a book, map, plan, graph, or drawing, all non-automated documents in filing systems are classified as records.
• Responsible party means a public/private body/person determining the purpose and means of processing PI, alone or with others.
• A person/organization is domiciled in a country if it is treated as their permanent home with a substantial connection to it, or if an organization has a registered office or primary business place there.

Primary Reasons for POPIA

• Aims to enforce constitutional right to privacy as per Section 2(a).
• Balances privacy with information access and flow as detailed in Sections 2(a)(i) and (ii).
• Ensures legal certainty by providing rights and remedies for those negatively impacted, detailed in Section 2(c).
• Responds to technological changes by protecting citizens' data with updated rights and remedies, according to Section 2(c).
• Harmonizes South African law with global standards, supporting international data transfers, outlined in Sections 2(a)(ii) and 2(b).

Application of POPIA

• POPIA applies to processing of PI entered into a record by (or for) a responsible party domiciled in South Africa or using automated/non-automated methods of processing information within South Africa.
• POPIA doesn't apply when a responsible party only transfers information through South Africa.
• All organizations use PI of staff, clients, and suppliers, POPIA affects every South African business.

Types of Personal Information and Processing Requirements

• Distinguishing personal, special, and children's information is important, children's and special personal information demands the most strict requirements when processing.
• Personal information is data revealing identity, a name/ID number, per POPIA section 1.
• A responsible party can process PI if the data subject consents and POPIA section 11 conditions apply.
• Processing is allowed if necessary for contract compliance, legal requirements, data subject protection, public law duty performance by a public body, or to pursue responsible/third-party legal interests, and consent is one condition.
• Special personal information includes sensitive details like religious/philosophical beliefs, race, trade union membership, political beliefs, health/sex life information, biometrics, or criminal behavior, it generally requires regulator exemption or sections 27-23 conditions.
• Special personal information processing is allowed with data subject consent, to establish/defend legal rights, comply with international public law, or for historical/statistical/research purposes serving public interest with privacy safeguards.
• It's okay to process special personal info made public by the data subject, information regulators also authorize special personal information processing.
• Children's PI involves data of individuals younger than 18, processing requires POPIA section 35 conditions.
• A responsible party can process a child’s PI with competent person consent, to establish, exercise, or defend legal rights, comply with international public law, or if the child has made the info public with competent person consent.
• Historical, statistical, or research processing of children's PI is also allowed if serving public interest, with protections for privacy.
• The information regulator can authorize processing children's PI if it's in public interest and safeguards are present.

Penalties for Non-Compliance

• Penalties include fines between R1 million and R10 million, along with jail time, ranging from 1 to 10 years.
• Non-compliance may lead to vulnerabilities in civil claims/liability, loss of company reputation/client trust, decreased millennial interest, and difficulty in securing international contracts/ business.

POPIA Compliance Guidelines

• POPIA requires eight data protection principles are to be followed, functioning as compliance guidelines based on OECD guidelines, covering data collection, quality, purpose, use, security, openness, participation and accountability.

The Eight Data Protection Principles

• Require application when processing to align with POPIA.
• The Accountability principle require taking steps for all compliance processing.
• Requires the responsible party ensures lawful information processing under POPIA Section 8.
• A Privacy by Design approach means responsible parties need to consider compliance before processing, incorporating privacy into IT and operational design.
• With the ‘Accountability’ principle, an org aims to documents what PI collected and where stored, indicators to show where PI is stored and what security used, service agreements with suppliers including internal guidelines, ongoing training and awareness, and review of PI/security measures on an individual level.
• The Processing Limitation requires processing fairly, lawfully, and with consent, only if "adequate, relevant, and not excessive".
• In excessive processing, like a courier needing health information for delivery, a responsible party must collect PI directly from the data subject and not surprise the data subject about why they are collecting their PI.
• Consent allows data subjects to retract consent and have data subjects knowledgeable about why their PI is being collected.
• Exception to direct collection occurs only when a third party can access the PI. and the responsible part ensures data subjects consent to share.
• Exceptions to the general rule includes consent by data subject/competent person or data from public records or consent to data collection that serves legal interests.
• A responsible party can collect PI from another source: to avoid legal interference by a public body, enforce revenue collection legislation, for court proceedings, or in national security interests.
• A data subject may object to PI processing or removes consent if the lawfulness is not affected (Section 11(3) POPIA).
• This includes lawful processing requirements for contracts and the law which makes consent withdrawal be unlawful because an organisation is legally required to process.
• Forms to object are based on POPIA Regulations, where data subjects must object in written format to the responsible party (or designated person).
• The form demands data subject /responsible party details, and details on objecting.
• Other lawful processing occurs when collecting race for employment equity or when seeking to promote transparency.
• Request for consents requires separation from any other contract or form, no pre-ticked boxes, providing organization details, 3rd parties involved, and allowing the client to consent independently per data processing use.
• Requests for consent need to to include rights of data protection, withdrawing consent and outlining the withdrawal process.

Specified Purpose Principle

• This principle ensures PI is collected lawfully for declared purposes where clients should know why their data is gathered.
• In a HR background check, HR representatives adhere to the specified purpose principle when using PI to inform Siya of the background check,.
• Following measures show compliance, this principle includes collecting PI for lawful/defined purposes outlining and stating data usage policies are needed in saved notices, contracts and privacy polices.

Furthering Processing Limitation

• Processing ensures it aligns with the initial purpose by ensuring PI processing adheres with initial reason.
• For example a doctor properly transferring your PI to a pharmacy to conduct a delivery.
• Must consider the relationship between current and all previous parties.
• Requires a careful view of data subjected and implications.
• Requires following guidelines and requirements with internal procedures, requires training for all staff, ensuring internal administrative procedures following policy guidelines
• It is compatible with collecting PI if coming from public records, data subject/competent person consents, used for research purposes (never to be published), compliant with Regulator exemptions, prevent public health threat.

Quality Principle

• Requires reasonable steps to maintaining complete, accurate, and updated PI.
• An example adhering to insurance regulations, an employment insurance requires saving personal information into company databases (ensuring that the that all details are updated and current). With that quality is ensures the organization follows quality implemented measurements. And maintains those measures by holding accountability on ensuring the PI follow standards.

Openness Principle

• Demands organization has documentation for processing PI
• By clearly informing clients about data usage, steps must be taken by ensuring full transparent use regarding POPTA polices.

Drafting to Notify

• An organization must explicitly notify data subjects for names, address reasons as to why its mandatory and the possible consequences. For all previously used data collection efforts, following all POPTA guidelines will fully comply.
• Step 1 The notice should authorize / collect PI following Employment standards
• Under step two when drafting a notification it requires telling 3rd parties who the notification is to be transferred to, both it must be applied under the organizational regulations
• The privacy notice must include the recipient, categories, the nature, category and how is the data subject allow to fix their PI
• And the detail to lodge complaint with contacts.

Security

• Security requires measures to protect data by using proper data procedures to follow safeguards and goals.
• Requires regularly verifying the effectiveness and safeguards as well as the register. When applying controls and safeguards to maintained. With its goal being to secure data, minimize data breaches.
• For sensitive situations of compromised information POPTA required: Maintaining and integrity of personal data by following all security measures and processes. While handling the safety of password and storing PI
• Organizations requires due diligence to follow measures in a contract.

Breach Protocols

• Requires authorizing access to those with permission and keep all PI confidential. To prevent disclosure (An operator / anyone requires confidential maintenance)
• This mandates if a breach happens organizations must efficiency respond by establishing all rules towards safely managing tech, personal procedures so that all people follow the procedures and guidelines.
• The breaching parties requires needing to immediately notify regulators while providing all those that was unauthorized.
• All operators must following the timeline of informing those "reasonable steps."
• The written statement must include to the individual in both physical, digital, media form for security measurements as well as those unauthorized.

Data Subject Participation Principle

• Data subject requests confirmation from the responsible party if it holds PI for data subject for no free of charge
• Data subject requests record from the responsible, all 3rd party description require a fee
  • Given all that time it requires an understandable/organized method with POPTA.

Comparing POPTA and GDPR

• Drafters depend heavily on EU framework and GDPR sharing more similarities while understanding EU. Enforcing best practice and applying within organization
• GDPR protecting all residence in Europe by understanding its regulation by south African companies.
• GDPR and POPTA having drawn different well developed systems similar to EU and UK.
• Differences on the framework for both POPIA + GDPR follow the table below:

Personal data be in placed for integrity-protect standards for PIS|PI must in processing and in measures by the controller and process Subject right provides freedom and proof with charged governed by POA|article to subject those in control

Subject right request those in data can with with free under POPTA|The data subjects participation is Article

• Both provide their Right to PI by understanding their notification
• Provide whether the details and proper management to the regulation
• And both should follow the procedure

Exemptions to regulation's

• All PI that have pass or death, and when applying to a body for guarding or security
• Exemptions requires showing interest

Under POPTA who's accountable

• Requires all parties both public/private so those details are in means of proper usage PI. And to use that data
• Requiring duties is to fully indemnity clause, well with contract well in secure format for all parties.
• Requires written format where there's not a relationship between employ and to proper ask. Securing reasonable authority to properly demonstrate.

Operators

• Is to only know and authorize of those who are confidential.

Liabilities

• The information officers it those responsible with fully complies with POPTA. By those in authority for both South Africas, to oversee the right to secure process and laws.

DPO vs Data Protection Officer

• POPIA uses data protection as both frameworks while giving POPIA framework
• Following duty of to the deputy where duty can delegate where those retain responsibilities.
• While having both the EU standards this used to show which officer best to put duty within there role.
• For organization needs the needs that shows that they are both processes by POPTA well with EU to meet the those certain needs of data and personal information.

GDPR

• Under specific cases needs DPO and data from all members

DPO and DPO Deputes

• That following to build good communication with the organization that meet with the risk or compliance.
• Having the well and to be the knowledge that helps comply those all safety process
• Engaged data to work to all sector to work with any changes in technology and to follow measure requirements
• And provide the duty to maintain that power

Information Officer

• To fully process data, to the laws by working to the compliance laws .
• For the information to be fulling understood they can show independence for it to be applied
• That requires a resource to be able properly preform.

Requirements

• Staff have to reach proper levels of authority that they can not follow duty to cause conflicts
• With customers. All information to help in security.
• By stating that those must maintain and meet

Guidelines

• To make sure those in compliance make sure those well organize
• And fully maintain measures 2 create.
• Requires listing detail for all. Make sure the trans are well understood, To help access all proper measures in safeguard and information by those in charge. That shows compliance to POPTA when requesting access to