On or about mid 2021 a huge frenzy was caused on social media including Facebook, Instagram, Twitter and WhatsApp. A regulatory legislation on the use of personal data namely Protection of Personal Information Act no 4 of 2013 fully came into operation on the 30th June 2021. Institutions were required to be compliant with the regulations on lawful processing of personal information on or before the 1st July 2021. Failure to be compliant carried and continues to carry a penalty fee.
The purpose of the Act is to protect personal information belonging to both living natural persons and existing juristic persons utilized by private and public institutions. To also regulate the flow of such information across the borders of the country. The Act has requirements that must be met before an individual’s information is collected and used in fulfilling an organization’s purpose and in some extent sharing the personal information beyond the borders of the country or with international organizations.
The Act aim to protect the right to data privacy which is derived from S14 of the Constitution of Republic of South Africa- everyone has the right to privacy.
Two key definitions one should know about the POPI Act;
2) Processing of personal data – is defined as any operation or activity either automatic or analogous that collects, receives, records, disseminates, organizes, collates, stores, updates, modifies, retrieves, alters, consults or use personal information belonging to data subjects.
The Act requires institutions, companies, or organizations to lawfully process personal information, by processing the information in terms of the eight conditions provided under S 4 of the Act. These are the eight conditions that must be met to be compliant: Accountability, Processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. The second condition further provides under S 11 of the Act for consent to be given where the data subject is a child, the data subject is privy to a contract, there is a legal obligation on the responsible party to process the data, processing data protects a legitimate interest of the data subject, processing must be done to fulfil a public law duty and to pursue a legitimate interest of the responsible party.
Therefore, consent under the Act has nothing to do with uploading information such as pictures or videos by individuals on social media. The Act further exempts or excludes any processing of personal information done for personal or household purposes. You can post your birthday pictures, wedding collage or a photo with your colleagues without having to ask for consent. These exclusions can be found under S 6(1) & 7(1),(2) of the Act. The Act will only apply should the information processed on social media be used for commercial purposes i.e to offer professional services or to market businesses. In such instances, consent is required.
REFERENCES
2. Constitution of Republic of South Africa 1996.
BY RAMATSITSI ATTORNEYS
