Data protection legislation in a nutshell

July 2012 Security Services & Risk Management

When an organisation’s client, employee or customer’s personal details or information goes missing (for example, through human error, theft, hacking, data loss, or any other variety of data breaches), chances are good that these persons or so-called data subjects would not be made aware thereof by the organisation. In most instances, these data subjects’ first awareness would most probably be at the hand of fraudsters utilising their personal information to open bogus financial or retail accounts or to gain access to the data subjects’ existing accounts.

This usually leaves victims of such information theft with irrevocable harm that might range from bad credit records to unending lawyers’ letters. Examples are rife and it has been reported elsewhere that identity theft costs the country in the region of one billion rand per year. The bottom line; personal information is big business.

Until now in South Africa, organisations have paid little or no attention to the protection of personal information and data subjects have been left to fit the bill for their own financial, legal, administrative and emotional distress when data breaches affect them. Concomitantly, organisations have turned a blind eye. That however is all about to change and is already changing due to South Africa’s own data protection initiative; the soon to be promulgated Protection of Personal Information Act (POPI) whereby data subjects will not only have recourse to legislation but also access to and protection under POPI’s enforcer, the Information Regulator.

Under POPI, almost every person or organisation that processes (collects, uses, retains, stores or destroys) personal information would be held accountable for that information. Typical examples of personal information are information relating to an identifiable, living person’s name, address, e-mail address, telephone number, race, gender, account numbers, blood type, ID number etc.

Accountability means that organisations that are subject to POPI would have to ensure conditions for lawful processing. Such conditions are:

* A limitation on the processing of personal information (one would, for instance, only be allowed to process personal information if you have obtained the data subject’s consent);

* Purpose specification (personal information must be collected for a specific purpose and can only be retained for as long as necessary);

* Further processing limitation (in other words, not to process personal information for any additional purposes beyond the initial purpose or data subject’s consent);

* Information quality (the organisation must ensure that the personal information is accurate, complete, not misleading and updated where necessary);

* Openness (organisations must make the data subject aware of the information being collected and indicate for what purpose it is going to be utilised or processed);

* Security safeguards (ensuring the confidentiality, integrity and availability of personal information according to best practice but also ensuring that third parties processing on your behalf, comply with the same rigorous standards); and

* Data subject participation (facilitating processes whereby data subjects can amend or correct information pertaining to them).

From a technological and IT perspective certain aspects contained in these conditions stand out:

* CCTV;

* Information and data classification;

* Retention and backup;

* Information and data quality;

* Information and IT security; and for the purpose of our conclusion below, more significantly.

* Third-party processors.

Third-party processors, those organisations that make your organisation’s processing troubles seemingly go away, are now your organisation’s responsibility, under POPI, that is.

If personal information belonging to your organisation processed by these third-parties ends up in the form of a laptop on eBay, or goes astray and data subjects’ information is exposed or misplaced, then your organisation would be held accountable. And no, you cannot contract yourself out of a statutory duty.

So next time when a cloud computing service provider tells you that cloud computing has become a hot topic in the CIO’s arsenal and that IT departments across the board have discovered that the cloud is a significant weapon in freeing up budget, think carefully as to which questions you should really be asking them.

In my next article, I will be addressing some of these.

Francis Cronjé
Francis Cronjé

Francis Cronjé is an information governance specialist with a strong legal background having completed his LLM at the University of Oslo in Norway on ICT Law and Data Protection. He completed his BLC and LLB degrees at the University of Pretoria and obtained CIPP/US and CIPP/IT certification from the International Association of Privacy Professionals. He is the co-editor and co-author of Cyberlaw@SA and is heading up the consultancy firm, Φ franciscronje.com.

For more information contact Francis Cronjé, [email protected], www.franciscronje.com





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Risk management and compliance enforcement
Security Services & Risk Management
Having a risk management and compliance programme (RMCP) is not just a procedural formality; it is a legal requirement under Section 42 of the Financial Intelligence Centre Act (FICA).

Read more...
The dangers of poor-quality solar cables
Security Services & Risk Management Smart Home Automation
Reports indicate that one in six fires attended by South African firefighters is linked to substandard solar installations, often due to faulty wiring or incompatible components.

Read more...
Growing risks for employers
Security Services & Risk Management
With South Africa’s unemployment rate exceeding 32% and expected to rise beyond 33% this year, desperation is fuelling deception in the job market. Trust is no longer a given, it is a gamble.

Read more...
Chubbsafes celebrates 190 years
Gunnebo Safe Storage Africa News & Events Security Services & Risk Management
Chubbsafes marks its 190th anniversary in 2025 and as a highlight of the anniversary celebrations it is launching the Chubbsafes 1835, a limited edition 190th-anniversary collector’s safe.

Read more...
New law enforcement request portal
News & Events Security Services & Risk Management
inDrive launches law enforcement request portal in South Africa to support safety investigations. New portal allows authorised South African law enforcement officials to securely request user data related to safety incidents.

Read more...
Continuous AML risk monitoring
Access Control & Identity Management Security Services & Risk Management Financial (Industry)
AU10TIX, launched continuous risk monitoring as part of its advanced anti-money laundering (AML) solution, empowering businesses to detect behavioural anomalies and emerging threats as they arise.

Read more...
Growing risks for employers
Security Services & Risk Management
With South Africa’s unemployment rate exceeding 32% and expected to rise beyond 33% this year, desperation is fuelling deception in the job market. Trust is no longer a given, it’s a gamble.

Read more...
Managing mining physical security risks
Zulu Consulting Security Services & Risk Management Mining (Industry) Facilities & Building Management
[Sponsored] Risk-IO, a web app from Zulu Consulting, is designed to assist risk managers in automating and streamlining enterprise risk management processes, ensuring no steps are skipped and everything is securely documented.

Read more...
SAFPS issues SAPS impersonation scam warning
News & Events Security Services & Risk Management
The Southern African Fraud Prevention Service (SAFPS) is warning the public against a scam in which scammers pose as members of the South African Police Service (SAPS) and trick and intimidate individuals into handing over personal and financial information.

Read more...
Rewriting the rules of reputation
Technews Publishing Editor's Choice Security Services & Risk Management
Public Relations is more crucial than ever in the generative AI and LLMs age. AI-driven search engines no longer just scan social media or reviews, they prioritise authoritative, editorial content.

Read more...