Protection of Personal Information Bill (POPI)
-
Upload
robert-maclean -
Category
Business
-
view
115 -
download
0
description
Transcript of Protection of Personal Information Bill (POPI)
Protection of Personal Information Bill
Agenda
Going to cover most of the law
Purpose to give an overview and provide a starting point for further
discussion and action
This is not about the Protection of State Information Bill aka “Secrecy
Bill”
Disclaimer
I am not a lawyer (duh) – this is about a law – thus you should have a
lawyer check and work with you on this.
We are talking about a bill, not an act.
Not covered:
The legal aspects about the regulator and information protection officers.
Code of conduct aspects.
Unsolicited Electronic Communications aspects.
Goal of the bill
To promote the protection of personal information processed by public
and private bodies; to introduce information protection principles so as
to establish minimum requirements for the processing of personal
information; to provide for the establishment of an Information
Protection Regulator; to provide for the issuing of codes of conduct; to
provide for the rights of persons regarding unsolicited electronic
communications and automated decision making; to regulate the flow of
personal information across the borders of the Republic; and to provide
for matters connected therewith.
One Page View
Colle
ct In
form
ati
on Must
collect direct from personSome exclusion apply
Pro
cess
In
form
ati
on Process
means anythingSome limits on what you can process
Rete
nti
on Keep for
as short a time as possible
Dele
tion Delete so
it is not recoverable
Secu
rity Reasonabl
e security steps must be taken D
ata
Su
bje
ct
Part
icip
ati
on
You can find out who has your dataYou can change your data
Noti
fica
tion Notificatio
n must be given if there is loss or damage to data
En
forc
em
en
t
Punishments
Timelines
Section 14 of the Constitution: Every has a right to privacy
Bill created in 2009
Seven drafts to date
Expected to be enacted in three to six months1
Companies will have between six and twelve months to put the law
into place.
1. Webber Wentzel Attorneys: http://www.mondaq.com/404.asp?404;http://www.mondaq.com:80/x/184466/data+protection/POPI+Snapshot+Tougher+Laws+For+Privacy+Breaches&login=true
Who this applies to
This is aimed at protecting the information of all citizens of the
country – so you!
Any company that processes or outsources data to third parties needs
to comply with it.
As all organisations have information on staff, share holders etc… this
means all businesses are affected.
Who it doesn’t apply to
is non-commercial, and non-governmental or related to household
activities;
has been de-identified to the extent that it cannot be re-identified
again;
is held by or on behalf of a public body, which involves national
security or deals with the identification of the proceeds of unlawful
activities and the combating of money laundering activities;
is created exclusively for journalistic purposes.
What does it apply to?
‘‘processing’’ means any operation or activity or any set of operations,
whether or not by automatic means, concerning personal information,
including—
(a) the collection, receipt, recording, organisation, collation, storage,
updating or modification, retrieval, alteration, consultation or use;
(b) dissemination by means of transmission, distribution or making
available in any other form; or
(c) merging, linking, as well as blocking, degradation, erasure or
destruction of information;
Processing Limitations
Must process lawfully
Minimal set of data
Relevant data only
Give the purpose
Consent must be given
Required for the conclusion or performance of the contract
You may opt out, at any time, and the processing must stop
Impact on the cloud?
Applies to all people & companies that are within South Africa
and
Applies to all people & companies that have systems that do
processing in South Africa
There is additional consent need to store & process data outside of
the borders of the country
Collecting Informationhas implications to further processing
Must be collected directly from the data subject
Except
It is in a public record already
The data subject has consented to collection from a third party
Collection from a third party without consent, where it would not prejudice
the data subject
Collection from a third party without consent where it is required
For example getting a criminal record from the police
Retention
Kept only for the processing
Can be kept for longer if
Required by law
Required for functions/activities
Agreed to in contract
Historical, statistical or research provided appropriate safe guards
Retention for Decision Making
Data must be retained for as long as the law says
If there is not law, for a reasonable period
This is so that access requests can be fulfilled
Destruction of Data
Data must be destroyed ASAP
Data must be destroyed in such a way it cannot be reconstructed
Security Measures
Reasonable technical & organisational measures to prevent
Loss of & damage to data
Unlawful access
What do you need to do
Identify all risks (internal & external)
Maintain & regularly validate safe guards
Follow generally accepted information security practices
Notification of security compromises
Must notify the regulator
Must notify the data subject
Must be done ASAP, except if instructured by SAPS, NIA or regulator to delay
Notification must be done in one of the following ways
Mailed to physical or postal address
Emailed
Placed on the web site
Published in the news media
As directed by the regulator
Notification must contain enough information for the data subject to take protective measures
Must, if known, contain the identity of the unauthorised person
Data Subject Participation
A data subject, having provided adequate proof of identify, can
request, free of charge, if a company has information on them.
A data subject, having provided adequate proof of identify, can
request what the information is & who it has been provided to.
Reasonable cost can be applied but an estimate must be given first.
Parts can be denied – requires compliance with grounds set out in
PIPA
Data Modification
A data subject can request the data to be changed or deleted
The reasonable party must comply with it, and provide evidence of it.
You may not process parts of information if they relate to
Children
data subject’s religious or philosophical beliefs, race or ethnic origin,
trade union membership, political opinions, health, sexual life or
criminal behaviour.
There are reasonable exceptions for example
Religion: If the information is being processed by an organisation and the
data relates to belonging to that organisation. For example religious
information & churches
Health: if the organisation is an insurance or medical organisation
Notification
The regulator must be notified prior to initial processing, must include
Name & address of who is using the data
Purpose
Description of data collected
Who the data will be supplied to
If it will leave South Africa
Description of security measure
Enforcement
Process: Complaint Decision of Action Investigation Assessment
Enforcement Notice Appeal
Can issue warrants and do search & seizure
Offences: Obstruction, breach of confidentiality, failure to comply
Penal sanctions: Imprisonment (up to 10 years) and/or fine
Fine: R 10 million1
Civil action can also be taken
1. Webber Wentzel Attorneys: http://www.mondaq.com/x/189552/data+protection/POPI+Snapshot+Penalties+Under+The+Bill
Impact on other lawsAmendments & Repeals to
Promotion of Access to Information Act, 2000
ECT Act, 2002
National Credit Act, 2005
Examples
Blackberry with company information left on train & does not have a
pin. The company is at fault. 1
Outsourced company doing storage of backups and loses the backup
medium. The backups contain customer information. The backup is
not encrypted. The company is at fault. 2
1. Webber Wentzel Attorneys: http://www.mondaq.com/404.asp?404;http://www.mondaq.com:80/x/184466/data+protection/POPI+Snapshot+Tougher+Laws+For+Privacy+Breaches&login=true2. Webber Wentzel Attorneys: http://www.mondaq.com/x/189552/data+protection/POPI+Snapshot+Penalties+Under+The+Bill
KPMG Cheat Sheet
From: http://
www.kpmg.com/ZA/en/IssuesAndInsights/ArticlesPublications/Protecti
on-of-Personal-Information-Bill/Pages/default.aspx
Broken down into the eight principals and has a number of easy to
answer questions about an organisation that can help comply.
Shorten List
Have someone accountable in the organisation for the management of data, data
information policies & managing communication in this regard
Have a document of data we collect
Detail how & why it was collected, if further processing is needed and when it will be
destroyed
Include the why on the documents we use
Educate staff on this
Ensure we have security risk assessments for the data and that reasonable security is
in place in all areas
Ensure people have a way to access & update their information