Archive of News

POPI: Openness is not just a value

The Protection of Personal Information Act, No 4 of 2013 (POPI) is aimed at protecting individuals' constitutional right to privacy. POPI prescribes eight conditions for the lawful processing of personal information. The eight conditions are:

1. Accountability;

2. Processing limitations;

3. Purpose specification;

4. Further processing limitation;

5. Informal quality;

6. Openness;

7. Security safeguards; and

8. Employee participation.

This article only deals with condition 6, namely openness.

Openness

This processing condition is aimed at ensuring transparency and fairness in the processing of personal information.

A particularly onerous duty placed on the employer is that before processing, it must take reasonably practicable steps to ensure that the employee is aware of a number of facts, such as:

• The information being collected;
• The purpose of such collection;
• The law authorising or requiring the collection of information, if applicable;
• The name and address of the employer;
• The consequences of failure to provide information;
• Whether the supply of information by the data subject is voluntary or mandatory; and
• Who will have access to the information.

Employers must maintain documentary records of all processing of the personal information of their employees.

If the employer intends to transfer employees' personal information to a country outside of South Africa, the employees must be notified of this.

The employee must also be informed of their right to access that information and the right to rectify it and/or object to the processing of the personal information.

An employee must be informed of their right to lodge a complaint with the Information Regulator together with the Information Regulator's contact details.

Employment agencies must make a job applicant aware of the names of the various organisations to which they will be sending an applicant's information and how that information will be used.

POPI also requires an employer to notify the Information Regulator of its intention to process personal information and state the true purpose served by such processing.

Exceptions

Section 18(4) of POPI provides for limited instances when a responsible party is not required to notify the data subject of the relevant information pertaining to the processing of their personal information.

These instances include where:

• The data subject has provided consent to the non-compliance;
• Where non-compliance would not prejudice the legitimate interests of the data subject;
• Where non-compliance is necessary to comply with an obligation imposed by law, for the conduct of proceedings in court or in the interests of national security;
• Compliance would prejudice the lawful purpose of the collection;
• Compliance is not reasonably practicable in the circumstances of the case; and
• The information will not be used in a form in which the data subject may be identified or will only be used for historical, statistical or research purposes.