The final commencement date of the Protection of Personal Information Act, 2013 (“POPIA”) was recently announced. This was reported on in last week’s issue of the Glacier Weekly where we explained POPIA and the implications of its commencement.
Over the next few weeks we’ll focus on one specific aspect of POPIA, in detail. In this edition we’ll start with taking a closer look at the role players.
Quick recap – the crux of POPIA
Before we get into the detail, let’s quickly recap on what exactly POPIA aims to achieve. POPIA gives effect to the right to privacy as set out in the Constitution - it provides the regulatory framework within which organisations may process personal information (thereby giving individuals control over how their personal information is used or disclosed).
In essence, POPIA applies to the processing of personal information of a data subject by or on behalf of a responsible party.
The role players
POPIA identifies three main role players, namely:
- The data subject;
- A responsible party; and
- An operator.
Let’s look at each in more detail.
Who is the “data subject”?
The “data subject” refers to the person to whom the personal information relates. Personal information refers to information relating to an identifiable, living natural person or juristic person (e.g.: information relating to race, gender, marital status, age, health, disability, language, education and employment, criminal history, identity number, contact details, etc).
(*PS: we will discuss “personal information” in more detail in a later edition.)
Who is the “responsible party”?
Section 1 defines a “responsible party” as a public or private body (or any other person) which, alone or in conjunction with others, determines the purpose of and means for processing personal information.
Put simply: it’s the person/entity who decides what personal information must be processed and how it is processed.
*PS: POPIA only applies to responsible parties that are domiciled in the Republic (or, where not domiciled in the Republic, make use of automated or non-automated means to process personal information in the Republic).
A few examples of responsible parties:
- Retirement funds;
- Product providers;
- Financial Intermediaries;
*Remember: companies within a group each have separate juristic personality and are therefore separately regarded as responsible parties.
Who is the “Operator”?
Responsible parties will not always process personal information themselves – certain functions (which involve the processing of personal information) may be outsourced to a third party. In the context of POPIA, this third party is referred to as an operator.
An “operator” is defined as the person (natural or juristic) who processes personal information for a responsible party in terms of contract or mandate, without falling under the direct authority of the responsible party.
A few examples of operators:
- Tracing agents;
- Retirement fund administrators;
- Third party service providers.
The importance of a contract between the responsible party and the operator
Despite the fact that the processing of personal information may be done by the operator (and not the responsible party itself), it is ultimately the responsible party who decides what must be processed and how. The responsible party therefore remains ultimately responsible for ensuring that POPIA is complied with. (PS: the Information Regulator can hold the responsible party liable for contraventions by the operator.)
POPIA sets specific requirements for the processing of personal information by operators. It requires the responsible party to enter into a written contract with the operator which ensures:
- that the operator establishes and maintains the required confidentiality and security measures which apply to the responsible party (as set out in section 19); and
- places a contractual obligation on the operator to inform the responsible party if there was unauthorised access or disclosure of personal information.
The operator, in turn, must:
- process personal information only with the knowledge or authorisation of the responsible party; and
- treat personal information as confidential, unless required by law or in the course of the performance of their duties.
Conclusion
As stated above, the outsourcing of any services to operators which involve the processing of personal information on behalf of the responsible party does not absolve the responsible party from liability. It is therefore vital that responsible parties use only reputable operators and relook existing contracts to ensure that meets the requirements as explained above (and includes the appropriate indemnities!).
Now that we have discussed the role players, we can move on to taking a closer look at the types of personal information and the different requirements for the processing thereof, as well as what is meant by the term “processing”– more on this in the next edition.
