JULY 2021 – SOUTH AFRICA
POPI ACT and PAIA – INFORMATION REGULATOR NOTICES
It is important that employers note the following:
Commencement of certain sections of the Protection of Personal Information (POPI) Act
The Information Regulator has extended the commencement date of section 58(2) of the POPI Act, 2013 provision that requires organisations to obtain authorisation from the Information Regulator if they plan on processing certain categories of personal information referred to in section 57(1) of the POPI Act.
The amended notice was published in Government Gazette 44782 of 30 June 2021.
The following activities require prior authorisation from the Information Regulator:
· The processing of any unique identifiers of a data subject:
· For a purpose other than the one for which the identifier was specifically intended at collection;
· With the aim of linking the information together with information processed by other responsible parties;
· The processing of criminal behaviour or unlawful or objectionable conduct on behalf of third parties;
· Credit reports;
· Transferring special personal information or personal information of children to a third party in a foreign country that does not have adequate data protection laws.
The Information Regulator has determined 1 February 2022 (previously 1 July 2021) as the date on which these sections will become applicable.
To view the Government notice, follow the link.
Information Regulator takes over PAIA functions
As of 30 June 2021, the Information Regulator has taken over the regulatory mandate functions relating to the Promotion of Access to Information Act (PAIA) 2000 from the South African Human Rights Commission (SAHRC).
The PAIA Amendment Act requires that all previously developed PAIA manuals of both public and private bodies, unless exempt, must widen the scope to cover matters relating to the processing of personal information in terms of the POPI Act. According to the amended PAIA, private funding for political parties and independent candidates must also be recorded and made available to the public.
All public and private bodies currently exempted now have until 31 December to compile their PAIA manuals for availability in their place of business or through their websites, effective 1 January 2022.
To date, there has been an exemption in place that made provision where smaller private bodies are not required to have a PAIA manual in place. This exemption expired on 30 June 2021.
The Information Regulator announced that it will publish PAIA manual templates as a guide to assist with the compiling process of PAIA manuals.
To view the media statement, follow the link. |
