How will POPI impact your social media channels?
The Protection of Personal Information Act – affectionately known as POPI – was signed into law in November 2013. If your organisation isn't compliant, don't start panicking because you have a year to dot your legal i's and cross your legal t's. Seeing that the POPI Act's primary purpose is to protect individuals' personal information, the question on everyone's lips is: "What impact will it have on my company's social media channels?"
The primary, and most obvious, impact that POPI will have on your social media activities is that any and all information collected via your social media channels will be governed by POPI - just like all other customer information. For example:
- If you use your social media channels as for customer service purposes and you ask customers for their contact details, ID or customer numbers via private messaging, all of this information is governed by POPI.
How does POPI affect you if you use a social media agency?
If you use an agency to run your social media channels, they're operating as a third party on your behalf. As such, they:
- Collect and process customer information on your behalf, or
- View and capture your customers' information.
This means that the agency would be required to conform to the POPI requirements on your behalf.
You, or your agency, should also ensure that your actions aren't endangering your customers' private information. For example:
- If you ask someone to message you directly on Twitter, you run the risk of them replying publicly and so exposing their information. This happens more often that you think...
- A solution could be for you to initiate the direct message contact, and they can simply reply privately.
Take POPI into account when you develop your influencer lists
An influencer list is a list of people who are influential on various levels in social media channels. They may be customers, bloggers or simply people who have a large, influential reach. Many of the people on these lists are not journalists so their information is 'less public'.
If you have an influencer list then each person's private information is governed by POPI. (Find out here what 'personal information' includes. Believe it or not, 'personal information' has gotten a lot more meanings with the POPI Act.)
Follow these 5 steps to make sure your social media channels are POPI compliant
1. Evaluate your techniques for capturing social data. Ensure the capture, storage and use of the data complies with your overall company POPI governance.
2. Ensure that your company's risk officer (or whoever is responsible for POPI compliance) understands your social media channel objectives and how social media conforms to POPI.
3. Review your influencer lists and ensure you know:
- Which information is in the public domain and can be used 'freely',
- Where and how you got the information,
- What the purpose of original collection was, and
- You have permission to use the information.
You may be required to recollect information and get consent for using it in a broader context.
4. Ensure you have processes to deal with the regulator, complaints and security breaches
POPI serves as a general warning to all South Africans:
- The act only protects your private information and any information you share publicly will automatically fall outside of the protection of the POPI Act.
- If you list your e-mail address or telephone number on your Facebook page, and that information is publicly available, then it's free for companies to collect and use. You can't then claim protection under POPI if this information gets used.
Moral of the story: Be highly aware of what information you offer publicly as you can't claim protection under POPI for that information!
