Since the Information Regulator South Africa – IRSA – came into office in December 2016, the pace has been picking up in the market for Protection of Personal Information Act (POPIA) products and services.
This has had a spill-over effect on the Promotion of Access to Information Act (PAIA), which also forms part of the responsibilities of the IRSA.
Unfortunately not only has the pace picked up but there has been some confusion sown through what might best be described as questionable marketing practices and erroneous reporting. One contact of mine recently received an email which included the following statement “The Promulgation of POPI, (The Protection Of Personal Information Act) in the Gazette on 26 November 2013 now means you are required to update your PAIA Manual to incorporate the POPI.”
This is misleading, since the Government Gazette did not include the commencement of the POPI Act or even the commencement of the transition period. The same marketing email continued with the statement “ALL information users now must have strict chain-of-custody processes in place.” This is far from the case, as the POPI Act makes no reference to a “strict chain-of-custody”. In similar vein the email stated “Businesses or persons who use/hold/verify or even request your Personal Information MUST now conform to the Act.” Not true.
This will only be so under certain conditions once the POPIA transition period has ended and right now it has not even started.
The same email then offers to help with the appointment of a “Compliance Officer”. No such individual is mentioned or required in terms of either POPIA or PAIA. What is required is an Information Officer, possibly supported by one or more deputies depending on the needs of each organisation. In September the IRSA issued a set of draft regulations which included specific reference to the role and duties of the Information Officer, more about which is available at the IRSA web site.
Perhaps of greatest concern is the statement that “at (name withheld) we made it very easy for you to get compliant in a simple and completely tax deductible manner. It takes you about 10 minutes to complete this process on our website.” Given the duties outlined in the IRSA draft regulations this statement should at least be seen as misleading.
This and other marketing emails that I have seen also push organisations to create or update a manual to comply with PAIA. In truth there are numerous exemptions to that requirement. To check whether you need to publish a PAIA manual please refer to the notice that appeared in the Government Gazette on 11 December 2015, signed by the then Minister of Justice and Correctional Services. For a free copy of the notice visit www.gpwonline.co.za and search for edition 39504.
Not only commercial organisations are guilty of mis-stating the facts. The Star newspaper ran an article in the Saturday Star Personal Finance column during September 2017 which contained the statement “The 12-month grace period to comply with the PoPI Act has expired, and the legislation is being applied in the public and private sectors.” That is factually incorrect and I wrote to the author of the article twice in an attempt to have this incorrect statement corrected.
One of my letters (in part) appeared in the Personal Finance column on Saturday 30 September 2017 under the heading “Incorrect correction about PoPI Act”. The explanation of the true state of affairs was published along with an apology to me personally from the editor.
I repeat those contents below for completeness:
“On September 23 2017 on page 21 in the Personal Finance section an item appeared titled “Correction to article on PoPI Act”. Unfortunately the correction itself is incorrect. To state that the “12 month grace period for market compliance is now in force” is factually incorrect. The only sections of the PoPI Act that have commenced refer to the definitions of the Act and those provisions allowing the establishment of the Information Regulator South Africa (IRSA). These appeared in the Government Gazette in April 2014.”
In summary, be sure you are dealing with reputable sources when seeking advice on how and when to comply with new legislation in general and POPIA and PAIA in particular.