The protection of personal information is paramount these days with the advancement of computers and the internet. It is vital that both public and private bodies know what their rights and duties are in terms of The Protection of Personal Information Act 4 of 2013 (“POPI”) as the consequences of non-compliance could be severe.
POPI clearly sets out the rights and duties which need to be taken into account in order to ensure compliance. It is a process of weighing up the legitimate needs of an organisation to collect and use personal information for business and other purposes against the rights of individuals to have their personal information kept private and safeguarded against misuse.
POPI is wide in its definition of “personal information”. It includes but is not limited to:
- Any information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of a person.
- Information relating to education, medical, financial, criminal or employment history of a person.
- The email address, physical address, telephone number or any other particulars assigned to a person.
“Processing” of personal information includes the collection, receipt, recording, storage, updating or modification, retrieval, dissemination as well as merging, erasure or destruction of personal information.
Personal information can be shared when the client (or “data subject”) has consented to the processing or where there is an obligation imposed by law. An example would be the relationship between an attorney and an estate agency in the course of a property transaction. But at any time a data subject may object to his/her information being processed and is generally entitled to do so.
All personal information collected needs to be correctly and safely stored to prevent any unlawful access to the information and to prevent any loss and/or damage. Appropriate steps will need to be taken to ensure that the appropriate infrastructure is in place in order to secure the information. The information will need to be retained for the period of time set out in Section 14 of POPI and then the appropriate steps will need to be followed in order to delete or destroy the information.