Information Privacy Regulations Finalised Recently

It is no secret that South Africa’s Protection of Personal Information Act (“POPIA”) regulates the processing of personal information domestically. As legislation has increasingly evolved to tackle a cross-border challenge, POPIA’s provisions are aligned to stringent international standards. POPIA is structured in two instruments, the POPI Act and POPIA Regulations. The latter providing supplementary details of what is required to ensure legal compliance. On 14 December 2018, POPIA’s final version Regulations were promulgated affecting the implementation of SA information privacy law in several respects.

Enforcement Date

Certain provisions of POPIA are already in force and have been since 2018. Furthermore the Information Regulator has already been knocking on the doors of companies who have been complained about by data subjects. However, the application of other legal obligations and restrictions only take effect on a date to be determined by the legislature. One of the issues causing the delay of full POPIA enforceability is the promulgation of its Regulations. The promulgation of the latter in December brings complete legal enforceability under POPIA one step closer.

Stricter Regulation of Direct Marketing

Section 69 of POPIA requires direct marketers to obtain consent from data subjects in order to lawfully conduct campaigns targeting them. Failure to do so is an offence which carries heavy fines and penalties. The Regulations impose details regarding how such consent must be obtained. Namely, direct marketers are required to obtain a signed form from the data subject before electronic direct marketing can occur. Depending on how the regulation is implemented in practice, imposing this obligation could create a significant challenge to the direct marketing industry. Although stringent regulation could appear attractive to consumers, they should be reminded that the direct marketing industry is a significant employer and job creator in South Africa. Should the industry down-size, the limitations prescribed in the Regulations could become a poisoned chalice. Direct marketers should familiarise themselves with POPIA Regulations and ensure their organisation is streamlined to comply with POPIA without damaging revenue streams.

The responsibilities of the Information Officer

POPIA’s Regulations also contain further detail on Information Officers. Organisations are required to appoint an individual responsible for ensuring information privacy legal compliance. Much like a company secretary the Information Officer will be involved with legal implementing within their organisation. Amongst other requirements, this involves creating a compliance framework, conducting an information privacy impact assessment and creating a manual which outlines their organisation’s information privacy and security policies. While this seems daunting in practice, the responsibilities of an organisation’s Information Officer will most likely be supplemented by technology and privacy attorneys.

Elevated awareness of importance

As incidents ranging from Facebook’s data abuse to COLLECTION#1 continue to make headlines, the importance of legal regulation will escalate further. The Promulgation of POPIA Regulations are an encouraging step in the right direction as information privacy continues to be of domestic and global importance.

If you have not taken the necessary steps to comply with POPIA, contact SwiftTechLaw here.

The post POPIA REGULATIONS: PRIVACY LAWS ARE TIGHTENING appeared first on Swift Tech Law.