24/11/2020
๐ฃ๐ข๐ฃ๐๐: ๐ ๐ฃ๐ฟ๐ฎ๐ฐ๐๐ถ๐ฐ๐ฎ๐น ๐ฐ-๐ฆ๐๐ฒ๐ฝ ๐๐ฐ๐๐ถ๐ผ๐ป ๐ฃ๐น๐ฎ๐ป ๐ณ๐ผ๐ฟ ๐๐ผ๐๐ฟ ๐๐๐๐ถ๐ป๐ฒ๐๐
The media is still awash with warnings about the dangers of not complying with POPIA (the Protection of Personal Information Act). The risks of non-compliance are indeed substantial but whilst much is made of the fact that the Act itself is now in force, references to the one-year grace period for compliance expiring on 30 June 2021 appear only in the fine print (if at all).
But โ and this is a big but โ there are major benefits to understanding POPIA and starting the compliance process long before it becomes compulsory. The penalties for getting it wrong are sizeable, โpreparation makes perfectโ, you are giving yourself lots of time to get it right, and for many businesses, there is also good marketing potential in being able to tell your customers and clients that you are already addressing the situation.
Four practical steps to start withโฆ
Before we start on your action plan, get to grips with the fact that you will almost certainly have to comply fully with POPIA. As soon as you in any way โprocessโ (collect, use, manage, store, share, destroy, and the like) any personal information relating to a โdata subjectโ (customers, members, employees, etc), you are a โresponsible partyโ. Very few businesses will fall outside that net. Equally, you are unlikely to fall under exemptions like that applying to information processed โin the course of a purely personal or household activityโ. Get going with these steps โ
Assess what personal information you hold, how you hold it, and why: Figure out what personal information you currently hold, how you hold it, and why you hold it. To collect and โprocessโ such information lawfully you need to be able to show that you are acting lawfully, reasonably in a manner that doesnโt infringe the data subjectโs privacy, and safely.
You must show that โgiven the purpose for which it is processed, it is adequate, relevant and not excessiveโ, data can only be collected for a specific purpose related to your business activities, and can only be retained so long as you legitimately need to or are allowed to keep it.
Thereโs a lot more detail in POPIA, but you get the picture โ you cannot collect or hold personal information without good and lawful cause.
Check security measures, know what to do about breaches: You must โsecure the integrity and confidentiality of personal information in [your] possession or under [your] control by taking appropriate, reasonable technical and organizational measures to prevent โฆ loss of, damage to or unauthorized destruction of personal information โฆ and unlawful access to or processing of personal information.โ You are going to have big problems if there is any form of breach from a risk that is โreasonably foreseeableโ unless you can prove that you took steps to โestablish and maintain appropriate safeguardsโ against those risks. Bear in mind that whilst cyber-attacks tend to get the most media time, there are also other risks out there โ brainstorm with your team all possible vulnerabilities and patch them.
Any actual or suspected breaches (called โsecurity compromisesโ in POPIA) must be reported โas soon as reasonably possibleโ to both the Information Regulator and the data subject/s involved.
If third parties (โoperatorsโ) hold or process any personal information for you, they must act with your authority, treat the information as confidential, and have in place all the above security measures.
Check if you do any direct marketing: Most businesses donโt think of themselves as doing any โdirect marketingโ, but the definition is wide and includes โany approachโ to a data subject โfor the direct or indirect purpose of โฆ promoting or offering to supply, in the ordinary course of business, any goods or services to the data subjectโฆโ. So for example just emailing or WhatsApping your customers about a new product or a special offer will put you firmly into that net.
If your approach is by means of โany form of electronic communication, including automatic calling machines, facsimile machines, SMSs or e-mailโ, you must observe strict limits. Whilst you can as a general proposition market existing customers in respect of โsimilar products or servicesโ (there are limits and recipients must be able to โopt-outโ at any stage), potential new customers can only be marketed with their consent, i.e. on an โopt-inโ basis.
Get a start on procedures and training: Identify an โInformation Officerโ who will take on all compliance duties, establish procedures, and train your team in implementing them. Cover how you will collect the data, process it, store it, for how long, for what purpose/s and so on. What consent forms do you need and when/how are they to be completed and stored? You are much less likely to have a POPIA problem if everyone in your business (and most importantly you!) understands what your procedures are and implements them as a matter of course. Make sure that no functions โfall between two stoolsโ โ assign individual compliance tasks to named staff members and make sure everyone understands who is to do what.
This is a complex topic and there is no substitute for tailored professional advice. What is set out above is of necessity no more than a simplified summary of a few highlights.
Source: Minde Schapiro & Smith
