There are many crucial factors involved in the Protection of Personal Information Act (PoPIA). For compliance, it is imperative for organisations to fully understand all these factors and how they play out in the real world. Three of the crucial areas that must be discussed include de-identifying, information matching programs and filing systems.
De-identifying data refers to when data that could potentially identify someone is hidden or removed. This personal data of a data subject could be identifying either on its own or in combination with other data. Data is considered identifiable of a data subject if it reveals the data subject’s identity directly; if it can be manipulated to identify the data subject indirectly; or if it can be linked to other data which would in turn identify the data subject.
“Essentially, the de-identifying of the data is a cornerstone of PoPIA. This act is directly purposed to protect personal information. Therefore, it is imperative that organisations are aware of identifying data and that they take the necessary steps to make that data anonymous by hiding or removing it,” explains Carrie Peter, Solution Owner at Impression Signatures.
When organisations are working with data that is essential to provide the necessary service or business operation, any identifying data that is not required must be de-identified – and the data set must be completely de-identified before it is shared. “An example of this is an online order. Initially the customer’s name and address may be required for delivery, however, once the delivery has been made that identifying data is not required for stocktake records. The data should therefore be de-identified before sharing the stock numbers,” continues Peter.
Another key area of compliance is related to the use of an information matching program. This programme is designed to collect, compare, clean and organise sets of information. Two sets of information are matched and compared. This comparison can be done either manually or digitally and includes documents that hold personal information about 10 or more data subjects.
“When utilising these programs, it is imperative that consent is obtained for any and all information utilised and stored by an organisation. This consent needed extends to older data sets that are stored within the organisations’ filing systems and so on. This means that organisations need to track down, match, clean and sanitise their historical data sets to ensure that the data is consolidated and secured. Consent for new and historical data must be explicitly secured for each piece of data, for the exact reason that data is required,” adds Peter.
The third crucial area to be addressed is that of filing systems. Filing systems refer to any set of personal data records stored by an organisation. These records could be manually stored in a filing cabinet, or digitally stored, centralised, decentralised, or dispersed on a functional or geographical basis. This data can be accessed with specific search criteria, such as being searched alphabetically. For compliance, these records must be safely secured to avoid them being lost, stolen or misused. This can be achieved through restricting access to digital storage using a filing cabinet that can be locked. Access to these records should only be granted to those who have obtained the necessary consent from the data subject(s).
“All three of these areas are crucial when it comes to compliance to PoPIA. Once understood, compliance in these areas is easily managed,” concludes Peter.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version