First Thing, Daily Maverick's flagship newsletter

Join the 230 000 South Africans who read First Thing newsletter.

We'd like our readers to start paying for Daily Maverick

More specifically, we'd like those who can afford to pay to start paying. What it comes down to is whether or not you value Daily Maverick. Think of us in terms of your daily cappuccino from your favourite coffee shop. It costs around R35. That’s R1,050 per month on frothy milk. Don’t get us wrong, we’re almost exclusively fuelled by coffee. BUT maybe R200 of that R1,050 could go to the journalism that’s fighting for the country?

We don’t dictate how much we’d like our readers to contribute. After all, how much you value our work is subjective (and frankly, every amount helps). At R200, you get it back in Uber Eats and ride vouchers every month, but that’s just a suggestion. A little less than a week’s worth of cappuccinos.

We can't survive on hope and our own determination. Our country is going to be considerably worse off if we don’t have a strong, sustainable news media. If you’re rejigging your budgets, and it comes to choosing between frothy milk and Daily Maverick, we hope you might reconsider that cappuccino.

We need your help. And we’re not ashamed to ask for it.

Our mission is to Defend Truth. Join Maverick Insider.

Support Daily Maverick→
Payment options

‘Data is the new gold’, but without care is a commo...

Defend Truth


‘Data is the new gold’, but without care is also a commodity easily tarnished

Former BBC foreign correspondent Karen Allen. Photo: Supplied|Woman using smartphone with icon graphic cyber security network of connected devices. Photo:iStock|Desmond Brown, International Head of Business Development for TouchBase Pro.Photo:YouTube|Varsha Sewlal, a privacy and tech attorney.Photo:Supplied

The perils and practicalities of South Africa’s Protection of Personal Information Act. This was the topic under discussion hosted by Former BBC foreign correspondent Karen Allen, in conversation with international head of business development for TouchBase Pro, Desmond Brown and deputy information officer and legal executive at the Railway Safety Regulator, Varsha Sewlal. 

“Data is the new gold,” said former BBC foreign correspondent Karen Allen, during a Daily Maverick webinar on Thursday. 

Allen and Varsha Sewlal, who previously worked for the South African Information Regulatory and is currently the deputy information officer and legal executive at the Railway Safety Regulator, and international head of business development for TouchBase Pro Desmond Brown, discussed data protection and the implications of the Protection of Personal Information Act (Popia). 

South Africa’s Protection of Personal Information Act, 2013 came into effect fully on 1 July 2021.

“It’s, of course, been a really long haul. The legislation was actually drawn up in 2013, but it’s taken up until 2021 to get it all fully up and running,” explained Allen. 

“Popia gives effect to a constitutional right to privacy and we live in a data-driven world. And for me, the purpose of personal data protection isn’t just to protect your personal information; it goes beyond that because it’s an issue of protecting your fundamental rights and freedoms,” Sewlal said. 

One of the key constructs of Popia, Sewlal explained, is accountability. 

“You need to ensure that personal information is processed lawfully, and there are processing limitations in addition to that, which enables all personal information to be processed lawfully and in a reasonable manner,” she said. 

This is where you need to assess whether or not a data subject or their privacy is being infringed, added Sewlal.

The issue of consent

“The Act doesn’t specify any specific period of time of how long consent remains. It does not technically lapse after a period of time. However, should the purpose for which someone is collecting that data change, it would require an additional consent,” said Brown. 

Let’s use the example of signing up for a competition on a social media platform. 

“The purpose for which [someone is] collecting that data is to communicate with this individual about that competition. Should they take those details and use it to get in touch with the individual elsewhere, add that person to a marketing database or engage with that person on other mediums — the consent for that changes, because the purpose for which the data was collected has changed,” Brown explained. 

This means the person or company collecting the data would need to get additional consent from the individual whose personal information it belongs, according to Brown. 

Echoing what Brown explained, Sewlal said “the Act does not impose any time period [relating to consent], but it has to be specific and it has to be informed consent.” 

That should be the “rule of thumb,” added Sewlal. 

“If you look at the definition, which says it has to be specific, it has to be voluntary, it gives you a good idea of how you can circumnavigate the issue of consent within the realm of Popia,” she said. 

Is a telephone number considered personal information? 

“Absolutely,” said Sewlal. 

“[A telephone number] is a unique identifier…because any information that can be linked back to an individual, is a unique identifier,” she explained.  

Should we be concerned about the abuses of Popia?

Allen asked the two panellists whether citizens should be concerned about the government concealing information that should be publicly available under Popia, knowing that they are exempt. 

“Even state entities have to make sure that they’re maintaining a record of all their processing operations…But, given the exemptions, you could find that the state could say that it does not need to comply with that, or keep a record,” said Sewlal. 

However, Sewlal explained that there are other pieces of legislation that will come into play, such as the Promotion of Access to Information Act (Paia). 

“Paia also enables citizens to access information,” she said. 

“State entities would need to have a Paia manual, and in that manual they would need to specify to the public how you can request access to information that they hold, and they also need to identify the information that they hold,” added Sewlal. 

When considering both the Protection of Personal Information Act and the Promotion of Access to Information Act, “information should not be withheld, and citizens should be able to access information — it is a constitutional right after all,” she said. DM 

Subscribe to the Daily Maverick webinar newsletter and keep updated with our upcoming conversations.


Comments - share your knowledge and experience

Please note you must be a Maverick Insider to comment. Sign up here or sign in if you are already an Insider.

Everybody has an opinion but not everyone has the knowledge and the experience to contribute meaningfully to a discussion. That’s what we want from our members. Help us learn with your expertise and insights on articles that we publish. We encourage different, respectful viewpoints to further our understanding of the world. View our comments policy here.

No Comments, yet

Please peer review 3 community comments before your comment can be posted