The South African Information Authority has asked for comments on a change in the rules on the protection of personal data.
the Draft regulation Establish the procedure to be followed in certain circumstances provided for in the Personal Data Protection Act (POPIA), including how to:
- A person can object to the processing of their personal data;
- A person can request the correction, destruction or deletion of their personal data;
- Companies can request an individual’s consent to the processing of their personal data for unsolicited electronic direct marketing; and
- A person can lodge a complaint with the information authority.
Below, law firm Webber Wentzel outlined some of the key suggestions and what they mean to individuals and businesses.
Objection to the processing of personal data
The draft regulations created a flexible way of objecting to the processing of their personal data so that they can do so “in any appropriate way”.
“According to the draft regulations, organizations are obliged to expressly inform persons of their right to object to the processing of their personal data in a way that is different from other information transmitted to these persons. This may require some companies to reconsider their privacy policies, ”said Webber Wentzel.
Request to correct, destroy or delete personal data
The draft regulation stipulates that if a person asks an organization to correct, destroy or delete their personal data, the organization must inform that person of the measures taken within 14 days.
“The draft regulation now includes a definition that“ days ”are calendar days. Companies must ensure that they can adequately consider and respond to these inquiries within 14 calendar days, ”said Webber Wentzel.
Unwanted electronic communication
The draft regulations give a degree of latitude to organizations asking for a person’s consent to process their personal data for direct marketing through unsolicited electronic communications.
“The current POPIA regulations require written consent in the prescribed form, which is attached to the existing regulations.
“However, the draft regulation would allow an organization to obtain consent using a form essentially similar to Form 4, or ‘in any convenient way’.
Webber Wentzel said this development would reduce some of the administrative burden for companies to ensure compliance with this consent requirement.
Complaints to the information authority
The draft regulation provides for a simple procedure by which interested parties can lodge complaints with the information authority, with clarification on:
- Which parties can file a complaint?
- The information that must be included in the complaint;
- Where and how to file a complaint – including how to file a complaint on behalf of another person
- How to file a complaint without revealing your identity.
Commentary by Peter Grealy, Karl Blom, and Nozipho Mngomezulu of the Webber Wentzel law firm.
Read: South Africa needs a new Mxit after WhatsApp failure, says communications minister
Comments are closed.