The President has recently signed a proclamation (proclamation no. R21 of 2020) in respect of the commencement date for further sections of the Protection of Personal Information Act, 2013 (POPI) to come into effect. The commencement date of the various sections is 1 July 2020 and for sections 110 and 114(4) being 30 June 2021. The Sections which have been proclaimed to commence on 1 July 2020 are as follows:
Sections 2 to 38
These sections deal with the application of the provisions of the Act, the rights of data subjects, lawful processing of personal information and various exclusions. These also include the conditions of processing personal information in general for lawful data processing which are:
a) Accountability
b) Processing limitations
c) Purpose specification
d) further processing limitation
e) information quality
f) Openness
g) Security Safeguards
h) data subject participation.
Further conditions relate to the processing of information in respect of data subjects that are children and also special personal information.
Sections 55 to 109
Since some of the provisions in respect of the Information Regulator had already commenced previously, the proclamation by the President brings about the commencement of sections dealing with the Information Officer, their duties and responsibilities and makes provision for deputy information officers.
Furthermore, the proclamation brings to life the most crucial part of the Act which is your enforcement provisions. This section is of importance as it provides for, inter alia, how complaints are to be lodged, what actions are to be taken when complaints are received, the investigation by the Information Regulator, issuing and execution of warrants, search and seizures, exempted information between legal advisor and client, functions of the enforcement committee, right of appeal and so forth.
The offences, penalties and administrative fines chapter is also one of the chapters that contains sections that will take effect on the commencement date.
Section 114(1) to (3)
These are the transitional provisions of the Act which allow organisations a grace period of a year (12 months) to ensure that personal information processing conforms to the provisions of the Act and to allow measures to be put in place for compliance purposes. This period of compliance may be extended by the Minister in consultation with the Regulator, but such extension may not exceed the period of 3 years.
Section 110 and 114 (4) – To commence on 30 June 2021
Section 110 deals with the amendment of the laws that are stated in in the Schedule of the Act. The amendments of the laws contained in the schedule will only come into effect on 30 June 2021. This means that all the laws mentioned continue to apply to such extent that they are amended or repealed on the commencement date of this section.
Section 114(4) makes provision for the South African Human Rights Commission to conclude and finalise its functions referred to in sections 83 and 84 of PAIA once amendments to those sections in terms of POPIA have taken effect.
With mostly the entire Act being in full commencement. It has become increasingly important that all organisations commence with putting measures in place to protect the processing of personal information within their organisations and to ensure optimum compliance with all the provisions of the Act. Many organisations should at least have had some minimal measures in place in preparation and anticipation for the full implementation of the Act. If not, the one year saving grace compliance period should be used by all organisations to its full advantage.
Article By: Mduduzi Mdunge