Business advised to align with new data protection legislation

Livia Dyer, partner at pan-African corporate law firm Bowman Gilfillan, commented: "Data protection rules concern the protection of individuals’ private information, which is increasingly collected and stored electronically.

"The impact of the Bill on the manner in which information is collected, organised , stored, used and disclosed, as well as the potential for fines, enforcement notices and increased civil action for damages, makes it important for organisations to familiarise themselves with the legislation and to align their policies, processes and procedures.”

She noted that data protection was becoming more important across Africa with new laws having been passed in South Africa, and under consideration in Kenya and Tanzania. Ghana has already passed legislation in this regard. It is also on the horizon in Nigeria, Uganda , and Botswana and other countries.

"While the basic requirements remain the same as under common law, the new general data protection laws are much more specific and detailed with regard to how to comply with privacy rights,” said Ms Dyer.

"In addition, most data protection statutes establish new regulatory bodies and create new enforcement and penalty provisions.”

In South Africa, other laws that have separate privacy and data protection requirements include the National Credit Act, the Regulation of Interception of Communications and Provision of Communication-Related Information Act (Rica), the Codes of Good Practice under the Employment Equity Act, the Consumer Protection Act, the Promotion of Access to Information Act (PAIA) and the Banks Act. The requirements in terms of these specific statutes will apply alongside the general requirements to be imposed by the Protection of Personal Information Act (POPIA) when it comes into effect.

POPIA will introduce a new regulatory body, the Information Regulator, which will also be responsible for enforcing the Promotion of Access to Information Act.

The party responsible for compliance with data protection rules is the data controller who decides the purpose of data processing and the way in which personal data should be processed. Examples of data controllers are employers collecting personal information for HR purposes, credit bureaux and the police.

Consequences for non-compliance range from an enforcement notice issued by the regulator to civil actions for damages by an aggrieved data subject which can also be brought by the regulator on behalf of data subjects, penalties for criminal offences, such as, for example, failure to comply with an enforcement notice, and administrative fines levied by the regulator of up to R10 million.

Said Ms Dyer: "There is a transitional period of 12 months, and data controllers should ensure that they take the necessary steps to ensure compliance.

"Start with an audit as to what personal information is held, where and by whom. Establish what personal information is collected in one place and transferred to another, and review website and other privacy statements.

"Develop group-wide data protection policies and protocols and review IT outsourcing contracts and direct marketing activities. Review data collection activities and appoint an information officer for POPIA and PAIA purposes,” she advised.