As the Protection of Personal Information Act 4 of 2013 (hereafter referred to as the Act) has become fully operational since 1 July 2021 businesses have tended to be solely focused on receiving consent from people or clients.
The question to ask is: “Is consent enough to process personal information?”
The simple answer is no, although consent is one of the fundamental requirements in the Act. The Act requires more than just consent.
When referring to Section 18 of the Act, certain notifications must be given to a person when collecting their personal information. Such notification includes the following:
- What information is being collected;
- Should the information not be collected directly from the person the source must be identified that provides the information;
- Name and address of the party/business collecting the information;
- The reason why the information is being collected;
- Is the collection of information voluntarily or mandatory;
- What will happen should the information not be supplied;
- Informing the person which law authorises/requires the collection of information;
- Where the business transfers the information to a third country or international organisation, they must inform the person of such transfer as well as the level of protection by such country/organisation.
Section 18 also emphasise that the party that collects the information must inform the person of whom information is being collected from of their rights to the following:
- The recipient or category of recipients of the information;
- The category or nature of the information;
- That the person has the right to access and rectify their information with the party that collected the information;
- That they may object to the processing of their information;
- The information of the Regulator to lodge a complaint.
The notifications as mentioned above should be done before the information is collected, or as soon as possible after the collection has taken place.
Please note that Section 18 of the Act includes certain circumstances where notification does not have to be given when collecting information, but it will be advisable to give such notification before the information is being collected to ensure that your business is compliant with the Act.
Contact your SEESA Consumer Protection & POPI Legal Advisor to assist your business with any Consumer Protection & POPI needs. Alternatively, SMS the word “SEESA” to 45776 for an expert legal advisor to contact you.
References:
Section 18 of Protection of Personal Information act 4 of 2013
About the Author
Tian de la Rey started his career at SEESA in 2019 and is currently a Legal Advisor at SEESA’s Klerksdorp branch. He obtained his BA Law degree in 2015, and his LLB in 2017 from the North-West University.