POPIA goes the Weasel

You are likely to have been bombarded by emails from businesses you deal with, telling you how they are complying with something called “POPIA”. South Africa’s Protection of Personal Information Act (POPIA), drafted way back in 2003, was promulgated in 2020 and went into enforcement on 1 July 2021, triggering a slew of communications from company’s holding information about you.

POPIA applies to companies, organisations and other legal entities who are located inside South Africa and who process personal information.
POPIA Defined:
POPIA has a very broad definition of personal information, basically any kind of information relating to an identifiable, living natural person, company or similar legal entity, including but not limited to –
• names, addresses, telephone numbers, email addresses,
• information about age, race, gender, appearance, characteristics, sexual orientation, political convictions, religious beliefs, language,
• health data such as physical or mental health, well-being, disabilities,
• online identifiers such email addresses, IP addresses, cookies, unique IDs, search and browser history, location data.
POPIA creates a whole new set of rights for its citizens that they can exercise to protect their data and privacy, gain insight into what data is collected aboutthem, request it be corrected and deleted.
POPIA Rights
POPIA creates the following rights for South African citizens (data subjects) –
• Right to be notified about collection and processing of personal information
• Right to access personal information
• Right to request correction of personal information
• Right to request deletion of personal information
• Right to object to the processing of personal information
• Right not to have personal information processed for the purpose of direct marketing by means of unsolicited electronic communications
• Right to not be subject to a decision which results in legal circumstances based solely on the basis of the automated processing
• Right to complain to the Information Regulator
• Right to effect judicial remedy

In other words, South African citizens will be able to know when their personal in-formation is likely to be collected, and have the right to consent to it before it happens; will have the ability to re-quest that a website gives them access to see what personal information it has collected about them, as well as have that information either corrected or deleted altogether, among others.
POPIA establishes eight conditions for lawful processing of data in South Africa –
• Accountability (processing is lawful and done in a non-privacy infringing way)
• Processing limitation (processing only for the given purpose)
• Purpose specification (specific purpose must be explicitly defined)
• Further processing limitation (additional processing must still be in accordance with the original purpose that the end-user gave their consent to)
• Information quality (make sure that the data is complete, accurate and updated)
• Openness (documentation of all processing operations)
• Security safeguards (must ensure protection and confidentiality of personal information)
• Data subject participation (ensure that end-users can exercise their rights to access, correct and delete their data)
The main supervisory and enforcing body under POPIA is the Information Regulator (SAIR) that is established by the law itself

and endowed with the responsibilities of –
• providing education and training around the data protection law and compliance,
• monitoring and enforcing compliance on companies and organizations who process personal information in South Africa,
• handling complaints from data subjects,
• creating guidelines, regulations and industry codes of conduct for practical compliance with POPIA,
• facilitating foreign cooperation for the enforcement of compliance with POPIA outside of South Africa.
POPIA Penalties
Failure to comply with certain provisions of POPIA may result in the Information Regulator (IR) imposing an administrative penalty of up to R10 million as of 1 July 2021 or to imprisonment for a period not exceeding 10 years, or to both a fine and such imprisonment.
POPIA is expected to have a far-reaching practical impact on our lives. “South Africans will now have the right to privacy afforded to them by the constitution,” says Ahmore Burger-Smidt of Werksmans Attorneys. “We now need to deal far more diligently with the information we collect. Companies can only collect what is necessary and have a legitimate reason to collect that information.”
According to Francis Cronje, an information governance specialist the basic intention of POPIA, is “not to impede the free flow of information. It means that if you collect my personal information, you don’t lose it, andyou treat it with respect”. “Say I buy a watch and the shop asks for my name and surname,” says Cronje. “Now they’re not allowed to share that information with anyone else, or send me marketing without my consent. They can’t share it with people I’m not aware of, or that I haven’t authorised.”
As from 1 July 2021, you should receive fewer spam voice messages on your phone (known as robocalls), and fewer spam SMSes. It doesn’t mean they’re going away, says Elizabeth de Stadler, co-author of “A Guide to the Protection of Personal Information Act”. “But it will be much harder to do, and you will have more control over when you get them.”
POPIA Spam
You shouldn’t receive unsolicited ro-bocalls and spam texts – and that “unsolicited” is a crucial distinction. Com-panies need to ask your permission to send you marketing material. If you’ve given that permission, they can contact you until you ask them to stop. The buy-ing and selling of information will be much, much harder. Companies have built up huge databases of contact de-tails, including your phone number and email address, and these get bought and sold on the open market. That’s not al-lowed anymore – a company is not al-lowed to pass on your details to another party. And if they do, you can lay a com-plaint with the Information Regulator.
While companies can’t send you unsolic-ited SMSs or robocalls, they can still cold call you. That’s because, according to thenew laws, telephone calls don’t fall under electronic communication, says De Stadler. However, voicemails are covered. So robocalls get blocked, but an actual human phoning you up to sell you something is still allowed. If you want them to stop contacting you, you can formally ask them to stop, which they have to do in terms of the Consumer Protection Act.
POPIA doesn’t apply only to electronic documents – it applies to hard copies too. Businesses need to make sure that information is kept safely, and disposed of safely. They need to take reasonable steps to make sure they don’t get hacked and, if they do, they’ll need to tell you as soon as possible.
POPIA Scams
The rush to comply with POPIA has also led to a spate of scams and misinformation. You may also have received messages that WhatsApp group administrators are required to comply with POPIA. This is generally untrue as the processing of personal information in the course of a purely personal or household activity is excluded from the Act. Where a WhatsApp group is created to facilitate family related or personal matters, as in between family, friends or acquaintances, then POPIA will not apply. However, the situation may be different where the WhatsApp group is operated by a business for the purposes of marketing its products and/or services. In such a context, if the person is not a customer of the business, the business will be required to obtain consent before adding the relevant person to the WhatsApp group.