The grace period given to public bodies to remedy violations is a key weakness in the Protection of Personal Information Act (POPIA), according to the Information Regulator (InfoReg).
The regulator this week hosted a media briefing at its new headquarters in Woodmead, sharing insights into several high-profile cases and other key developments.
Since the InfoReg’s enforcement powers came into force on 1 July 2021, following a year-long grace period for organisations to comply with the Act, several seven-figure fines have been issued to POPIA violators.
However, those high-value fines have not materialised; instead public bodies in the wrong have challenged them in court, revealed InfoReg chairperson advocate Pansy Tlakula.
Asked to elaborate on some of fines the regulator has issued, she said when it finds a public body has breached POPIA, it gives the institution a specified period to bring itself into compliance. If the institution fails to do so, it can challenge the regulator’s enforcement action in court.
“The weakness in POPIA is the grace period,” said Tlakula. “What tends to happen is that public bodies comply within the timeframes, and once they comply, we cannot move forward with the fine. For those who go to court, we wait for legal processes to unfold.”
POPIA sets down firm frameworks that companies must abide by to avoid fines, criminal prosecution and potential reputation loss.
Breaching the rules and regulations outlined by the Act can have serious, long-lasting financial and reputational implications for the business.
It makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.
The regulator can give a public body a grace period to remedy a POPIA violation before taking further enforcement action.
In July 2023, the InfoReg imposed its first historic R5 million fine on the Department of Justice and Constitutional Development for breaching POPIA.
Since its enforcement powers came into effect, the regulator has also slapped the Department of Basic Education with a R5 million fine for breaching POPIA.
These have been the highest fines to date.
The InfoReg issued additional fines for the Electoral Commission (IEC) of South Africa and Lancet Laboratories, which have both paid the fines due, as well as the Blouberg Local Municipality in the Western Cape.
“We issued a fine; they [Blouberg Local Municipality] did not pay. We then went to court to verify that fine, and the court reduced the amount of R500 000 that we fined the municipality. It said the fine was too high, given it was a first offense.
“We have issued some fines, but we could do better,” said the chairperson.
Advocate Tshepo Boikanyo, InfoReg executive for POPIA, added that the IEC and Lancet Laboratories were each fined R100 000.
“The Blouberg Municipality fine…was reduced by the court from R500 000 to R250 000. FT Rams Consulting is a matter that we’re currently processing in in accordance with Section 109 of the Act. It relates to direct marketing and the fine that was imposed there is R100 000.”
Share
