Lexis Nexis
Protection of Personal Information
02 August 2018 00:00
The recent cyber-attack and holding hostage of a South African insurance provider’s IT infrastructure has drawn attention to the dire need for effective protection of consumer data.
While the company asserts that no financial losses have been encountered by any of its policy holders, it cannot currently confirm the volume of data and number of individuals that have been affected by this data breach.
Any organisation that handles consumer information will be significantly impacted by the introduction of data protection legislation. The Protection of Personal Information Act (POPI), which is expected to come into effect in 2018, prescribes how personal information may be stored, transferred and destroyed.
“All public and private entities will be required to comply with the legal obligations under POPIA,” says Billy Last, CEO of LexisNexis South Africa. “Non-compliance will result in severe penalties, fines and imprisonment in addition to reputational damage.”
Companies need to prioritise the enhancement of data security, the updating of vendor contracts and safeguarding trans-border flow of information. Entities will need to appoint an Information Officer and gain an understanding of the duties of the responsible party and the rights of the data subject, including how to be prepared and manage a data breach.
The Information Regulator has been established and the draft regulations for POPIA published. Following the implementation of the Act, a grace period allows companies the necessary time to ensure that their systems are compliant and meet the requirements.
“It is important that companies do not wait until the grace period is over to make the necessary changes – in fact they should start now even before the Act is promulgated,” says Last. “The Act will also oblige companies to report data breaches and detail their strategy for rectifying same.”
Last said the newly released book, A Commentary on the Protection of Personal Information Act, examines the eight conditions of lawful processing, the difference between personal and special personal information and the exemptions, exceptions and exclusions as set out in the Act.
The authors set out the powers of the Information Regulator and possible fines, compensation and damages and cover the impact of the POPI Act on several important issues including employment law; non-automated and automated decision-making; outsourcing of processing; marketing and direct marketing; credit reporting and the Internet.
“This is the first South African publication that covers the requirements for compliance to the General Data Protection Regulation (GDPR) which came into force on 25 May 2018, linking the POPI Act to these compliance obligations and has application to SA companies,” says co-author Ahmore-Burger Smidt. “Companies that offer goods or services to people in the European Union (EU), or monitor the behavior of people in the EU, will have to comply with the GDPR.”
POPI will bring South Africa in line with international data protection standards. It is widely accepted that the European Union has been at the forefront of the development of the framework for the protection of personal information. It is for this reason that the authors of A Commentary on the Protection of Personal Information Act have relied extensively on the General Data Protection Regulation (GDPR) to provide guidance on how POPI is likely to be implemented.
A Commentary on the Protection of Personal Information Act retails for R500.00 excluding VAT and delivery and will be available for sale from 5 July 2018 from the LexisNexis online store at:
Print ISBN: 9780409123418 and Ebook ISBN 9780639003542
About the Authors
Yvonne Burns
With a BJuris LLD from the University of South Africa (UNISA), Yvonne Burns was a Professor in the School of Law at UNISA for 30 years. Burns has published numerous textbooks with focus areas including Administrative Law and Communications Law.
Ahmore Burger-Smidt
Ahmore Burger-Smidt is a Director at Werksmans Attorneys and holds a BCom and LLB from the University of North West and a Master’s in Business Leadership Degree from the University of South Africa (UNISA). As a member of the International Association of Data Privacy Professionals, Burger-Smidt and has been advising clients on data privacy across a broad base of industries and sectors for many years. She has contributed to numerous publications and regularly lectures on data privacy legislation.
Image gallery
Below: A Commentary on the Protection of Personal Information Act is the essential handbook for those trying to navigate the POPI Act with useful reference to the requirements for compliance to the General Data Protection Regulation (GDPR) which came into force on 25 May 2018.
About LexisNexis Legal & Professional
LexisNexis Legal & Professional is a leading global provider of legal, regulatory and business information and analytics that help customers increase productivity, improve decision-making and outcomes, and advance the rule of law around the world. As a digital pioneer, the company was the first to bring legal and business information online with its Lexis and Nexis services. LexisNexis Legal & Professional, which serves customers in more than 130 countries with 10,000 employees worldwide, is part of RELX Group, a global provider of information and analytics for professional and business customers across industries.
In South Africa LexisNexis has been assisting companies and professionals to remain abreast of changing legislation and shifts in the regulatory environment for over 80 years, using leading-edge technology, tools and online solutions.
South African investment firm, Tsiya Group, chaired by Fani Titi, acquired a minority interest in the company in July 2012.