Ground-breaking privacy Act imminent

Bonnie Tubbs
By Bonnie Tubbs, ITWeb telecoms editor.
Johannesburg, 12 Sept 2012

A significant step towards the enactment of what has been called a ground-breaking law for personal privacy in SA - the Protection of Personal Information Bill (POPI) - was taken by the powers that be yesterday.

POPI, which has existed only in a working draft form up until now, edged closer to finalisation yesterday when it made its way through the National Assembly (NA) for its second reading. Tabled in 2009 and on the cards since the early part of this century, it is believed the Act will come to fruition before the end of the year.

According to local information governance specialist Francis Cronje, yesterday's development is a “huge step” in reaching finalisation of the legislative process. “Not only will this create certainty into what is allowed under the proposed legislation, but it will also start the facilitation of international and EU recognition.”

Web and digital media lawyer Paul Jacobson says POPI is significant in that it will be the first consolidated piece of privacy legislation for the country. “It is an important piece of legislation that will say what the human right to privacy entails, how companies can collect individuals' personal data and what they can do with it. It is to privacy protection what the Promotion of Access to Information Act is to accessing information.”

Jacobson says POPI is expected to be signed off and passed before the end of the year. “The final Bill version is now on the table and, short of any parliamentary changes, it will soon be voted on and, once signed off by the president, passed.” He says the implementation and compliance process will follow soon afterwards.

While there are still some procedures pending before the industry can celebrate POPI's enactment, it has been welcomed and seen by many as a pivotal means of protecting the consumer from abuse.

Away with spam

The Internet Service Providers' Association of SA (ISPA) says - in particular - it welcomes the fact that the Portfolio Committee on Justice and Constitutional Development, which voted on the Bill last week, opted not to adopt the options proposed on the definition of consent. “This would have effectively hanged POPI's position on unsolicited direct marketing to an opt-out position.

“ISPA is also pleased that consent is opt-in, which creates greater control for consumers over their personal information and unsolicited approaches.”

ISPA says it looks forward to the Bill becoming an Act so that it can continue its efforts to take action against unsolicited e-mail marketing sent from within SA.

The extent of the problem, says the Internet industry body, is reinforced by a recently-released Symantec report indicating that one in every 1.48 e-mails received by South Africans during July 2012 were considered spam, which made up 67.8% of all South African e-mail traffic during that period.

“We are pleased that the drafters have acknowledged the costs of unsolicited commercial marketing to individuals and broader society, and sought to adopt an approach which brings into play a better balance between consumer rights and marketing conduct.”

Act implications

Dimension Data says POPI is a “ground-breaking piece of legislation”. Up until now, the global IT services company points out, electronic data has only been covered by the Electronic Communications Act.

“[POPI] tightens up technology legislation in SA and focuses companies on taking responsibility for the responsible stewardship of data. It also attaches stiff penalties to any breaches or failures on the part of organisations that fail in this duty.”

Some of the implications, says Dimension Data, are that the role of the information officer in organisations will become more important; organisations will have to put a privacy and data protection policy in place as a matter of urgency; and heavy penalties for non-compliance will be meted out.

Road to ratification

Cronje says POPI is a Section 75 piece of legislation, which means it is an ordinary Bill that does not affect the provinces and that can only be introduced in the NA. Once it has been passed by the NA, he says, it must be sent to the National Council of Provinces (NCOP).

“In this case, delegates in the NCOP will vote individually and POPI must be passed by a majority of delegates present. If the NCOP rejects POPI or proposes its own amendments, POPI will be returned to the NA which could then pass POPI with or without taking into account the NCOP amendments, or it may decide not to proceed with POPI - let's hope not.”

Cronje says the NCOP's role in Bills that do not affect the provinces is therefore a limited one. “It can delay a Section 75 Bill, but it cannot prevent it from being passed.”