The Protection of Personal Information Act (Act 4 of 2013) came
into effect on 1 July 2020.
The purpose of the Act is to give effect to every persons
Constitutional Right to privacy, to promote the protection of personal
information processed by public or private Bodies, to introduce conditions to
establish the requirements for the processing of Personal information and to
provide for the establishment of an information Regulator to perform powers,
duties & functions.
Section 14 of the Constitution states that everyone has the
right to privacy and the right to privacy includes the right to protection
against unlawful collection, retention, dissemination and use of personal
information
The state should respect, promote, protect and fulfil
theses rights.
The Test for POPI is that if your business processes
personal information, enter it into a record or filling system and the
processing is done by a responsible person domiciled in South Africa, you will
have to comply with the POPI Act .
We are all required by law to comply. The processing of the
personal information is an asset to most companies because without it you won’t
be able to transact or do business. Compliance is becoming a prerequisite and if
you want to continue doing business with other companies you will have to comply.
The personal information should be processed lawfully and
in reasonable manners that does not infringe on the rights and privacy of the
data subject.
The information must be recorded into an automated or non-automated
system and the recorded documents should be in the possession of the
responsible party. The definition of automated is, any equipment capable of
operating automatically in response to instruction given for the purpose of
processing information, and the definition of non-automated is any filling
system.
The data subject or competent person or where it is a child
(the child should be assisted by a guardian), they will have to firstly give
their consent.
The processing should be necessary to carry out an action or for the
conclusion or performance of a contract of which the data subject is a party
to. If Processing complies with an obligation imposed by law on the responsible
person. Processing protects a legitimate interest of the data subject and the processing
is necessary for the proper performance of a public law duty by a public body.
The data subject may at any point before the processing of
information, withdraw his/her consent and the data subject may also object on
reasonable grounds relating to his/her particular situation unless legislation
provides for such processing.
We all have to be aware that the POPI ACT is now effective
as from 1 July 2020 and that we all have to comply with the act if we want to
continue doing business with other companies because it is a prerequisite and
because we are required by law to comply.