“Data is the new gold,” said former BBC foreign correspondent Karen Allen, during a Daily Maverick webinar on Thursday. 

Allen and Varsha Sewlal, who previously worked for the South African Information Regulatory and is currently the deputy information officer and legal executive at the Railway Safety Regulator, and international head of business development for TouchBase Pro Desmond Brown, discussed data protection and the implications of the Protection of Personal Information Act (Popia). 

South Africa’s Protection of Personal Information Act, 2013 came into effect fully on 1 July 2021.

“It’s, of course, been a really long haul. The legislation was actually drawn up in 2013, but it’s taken up until 2021 to get it all fully up and running,” explained Allen. 

“Popia gives effect to a constitutional right to privacy and we live in a data-driven world. And for me, the purpose of personal data protection isn’t just to protect your personal information; it goes beyond that because it’s an issue of protecting your fundamental rights and freedoms,” Sewlal said. 

One of the key constructs of Popia, Sewlal explained, is accountability. 

“You need to ensure that personal information is processed lawfully, and there are processing limitations in addition to that, which enables all personal information to be processed lawfully and in a reasonable manner,” she said. 

This is where you need to assess whether or not a data subject or their privacy is being infringed, added Sewlal.

The issue of consent

“The Act doesn’t specify any specific period of time of how long consent remains. It does not technically lapse after a period of time. However, should the purpose for which someone is collecting that data change, it would require an additional consent,” said Brown. 

Let’s use the example of signing up for a competition on a social media platform. 

“The purpose for which [someone is] collecting that data is to communicate with this individual about that competition. Should they take those details and use it to get in touch with the individual elsewhere, add that person to a marketing database or engage with that person on other mediums — the consent for that changes, because the purpose for which the data was collected has changed,” Brown explained. 

This means the person or company collecting the data would need to get additional consent from the individual whose personal information it belongs, according to Brown. 

Echoing what Brown explained, Sewlal said “the Act does not impose any time period [relating to consent], but it has to be specific and it has to be informed consent.” 

That should be the “rule of thumb,” added Sewlal. 

“If you look at the definition, which says it has to be specific, it has to be voluntary, it gives you a good idea of how you can circumnavigate the issue of consent within the realm of Popia,” she said. 

Is a telephone number considered personal information? 

“Absolutely,” said Sewlal. 

“[A telephone number] is a unique identifier…because any information that can be linked back to an individual, is a unique identifier,” she explained.  

Should we be concerned about the abuses of Popia?

Allen asked the two panellists whether citizens should be concerned about the government concealing information that should be publicly available under Popia, knowing that they are exempt. 

“Even state entities have to make sure that they’re maintaining a record of all their processing operations…But, given the exemptions, you could find that the state could say that it does not need to comply with that, or keep a record,” said Sewlal. 

However, Sewlal explained that there are other pieces of legislation that will come into play, such as the Promotion of Access to Information Act (Paia). 

“Paia also enables citizens to access information,” she said. 

“State entities would need to have a Paia manual, and in that manual they would need to specify to the public how you can request access to information that they hold, and they also need to identify the information that they hold,” added Sewlal. 

When considering both the Protection of Personal Information Act and the Promotion of Access to Information Act, “information should not be withheld, and citizens should be able to access information — it is a constitutional right after all,” she said. DM 

Subscribe to the Daily Maverick webinar newsletter and keep updated with our upcoming conversations.