(Portfolio Committee on Justice and Correctional Services) Annexure A Protection of Personal Information Act, 2013 (functions of Information Regulator) Department of Justice and Constitutional Development (Portfolio Committee on Justice and Correctional Services) 22 October 2015

Outline of the presentation Introduction Implementation of certain provisions of the PPI Act Establishment of Information Regulator Functions of Information Regulator Implementation of remaining provisions of PPI Act Importance of IR and impact on broader society

Introduction 1. Open Democracy Bill: Annexure A Introduction 1. Open Democracy Bill: (i) Sect 32 of Constitution - “Access to information” - national legislation to be enacted; (ii) Bill introduced in 1999; (iii) Draft provisions dealing with access to information, data protection and protected disclosures; (iv) Parliament— (a) approved Promotion of Access to Information Bill on 24/01/00; (b) requested that separate Bill be promoted dealing with data protection; and (c) approved Protected Disclosures Bill in 2000. 2. SALRC: (i) 17/11/00: approved research project into “Privacy and Data Protection”; (ii) submitted its Report, and proposed Bill, to Minister shortly before April 2009 general elections

Implementation of certain provisions of Act Section 1 (definitions), Part A of Chapter 5 (establishment of the Information Regulator) and sections 112 and 113 (Regulations and procedure for making Regulations, respectively) were implemented on 11 April 2014. Section 46 of the PPI Act provides that the members of the Information Regulator will be entitled to such remuneration as determined by the Minister of Justice and Correctional Services in consultation with the Minister of Finance. Minister advised the Speaker of the National Assembly accordingly at the conclusion of the consultation process. Members of IR – a Chairperson and four ordinary members, of whom at least two ordinary members must be appointed on a full-time basis (s41 of Act). Members are appointed by the President on recommendation by the National Assembly (recommendation must also indicate which ordinary members must be appointed on a full-time and part-time basis).

Establishment of Information Regulator IR is a juristic person which is independent and subject only to the Constitution and the law and must be impartial and perform its functions and exercise it powers without fear, favour or prejudice (s39 of Act). Chairperson must perform his/her duties in accordance with the PPI Act and PAIA. One ordinary member must perform his/her duties in terms of the PPI Act and the other ordinary member must perform his/her duties in terms of PAIA. The two remaining ordinary members must perform their duties in terms of the PPI Act or PIAIA or in terms of both pieces of legislation. The IR must establish its own administration, by appointing a Chief Executive Officer and such other members of staff as may be necessary (s47 of PPI Act). Funds of the IR will consist of such sums of money that Parliament appropriates annually.

Functions of Information Regulator Section 40, among others, provides that— IR must monitor and enforce compliance by public and private with the provisions of the PPI Act; and Exercise the powers conferred upon the IR relating to the access of information as regulated in terms of PAIA. Other functions entail: Exemptions: Chapter 4 deals with the Regulator’s power to grant exemptions (sections 36 and 37). Section 36, among others, provides that the processing of personal information will not be in breach of a condition for the processing of personal information if the Regulator grants an exemption in terms of section 37. Prior authorisation: Chapter 6 regulates "prior authorisation". Section 57 of the PPI Act requires that a responsible party must obtain prior authorisation from the Regulator prior to any processing of certain categories of personal information such as information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties. Codes of conduct: Chapter 7 introduces Codes of Conduct. The development of codes of conduct will contribute to the proper implementation of the conditions for the lawful processing of personal information, as reflected in Chapter 3 of the Act, in each sector. Section 60, among others, provides that a code must prescribe how the conditions are to be complied with within specific sectors as far as the processing of personal information is concerned. The Regulator may, in terms of section 61, issue codes on its own initiative or on application by persons who process personal information.

Functions of IR (continue) Enforcement mechanism: Chapter 10 of the PPI Act provides for complaints to be lodged with the Regulator by data subjects regarding any interference with the protection of their personal information. The provisions of the Chapter deal with the powers of the Regulator as far as investigation of complaints are concerned. Sections 81 to 88, for example regulate the various aspects associated with the investigations conducted by the Regulator. As far as the investigation of complaints is concerned the Regulator will, among others, in terms of section 81 be empowered to summon persons to appear before it, receive and accept any evidence and enter and search any premises that is occupied by a responsible party. The remaining clauses deal with procedural aspects in relation to the investigations to be conducted by the Regulator. These provisions deal with the issuing of search warrants (section 82); the requirements for warrants to be issued (section 83); the execution of warrants (section 84); matters that are exempt from searches (section 85); exemption of communication between a legal adviser and his or her client (section 86); the possibility of objections to be raised with regard to searches (section 87) and the return of warrants to the court that issued them after they have been executed or if they were not executed within the authorised period (section 88). Administrative fines: The Regulator will also be empowered to make a determination that a responsible party must take specified action, or cease to act in a specific manner, within a specified period for the purpose of complying with the provisions of the Bill. Failure to comply with the notices will be a criminal offence. Sections 95 to 98 of the PPI Act aim to give effect to the aforementioned. Section 109 of the PPI Act provides that the Regulator may impose administrative fines for the alleged commission of an offence in terms of the Act.

Functions of IR (continue) Regulations: Section 112(2) of the PPI Act empowers the Regulator to make subordinate legislation in the form of regulations, among others, with regard to― (i) the manner in terms of which a data subject may object to the processing of personal information; (ii) the processing of health information by certain responsible parties; (iii) the manner and form in terms of which a complaint must be submitted; (iv) the Regulator acting as conciliator in relation to any interference with the protection of personal information; and (v) the settlement of complaints.

Functions of IR (continue) The PPI Act also aims to assign all the responsibilities of the SAHRC in terms of PAIA, to the Regulator. The Regulator as the sole functionary, apart from the courts, will consider complaints against decisions that have been taken by public or private bodies in respect of requests for access to records of the bodies concerned. The complaints procedure regulated in terms of PAIA will be amended as follows: (i) Insofar as certain public bodies are concerned, the compulsory internal appeal procedure will be retained. A party who is aggrieved by a decision of the relevant authority will have an option to either submit a complaint to the Regulator or to approach the court for appropriate relief; and (ii) a party who is aggrieved with a decision by the head of a private body will be able to either submit a complaint to the Information Regulator in respect of the decision concerned, or to approach the court for appropriate relief.

Implementation of remaining provisions of PPI Act The remaining provisions of the PPI Act, namely Chapters 1 to 4 and 6 to 12, can only be implemented once the Information Regulator has been established. These Chapters not only create certain obligations in respect of the processing of personal information, but also create certain rights and remedies. Since the Regulator will play a crucial role in monitoring compliance by responsible parties with the provisions of the Act and handling complaints by data subjects, the provisions concerned can only be implemented after the establishment of the Regulator.

Importance of IR and impact on broader society IR will, among others, be responsible for— providing education by promoting an understanding and acceptance of the PPI Act; undertaking educational programmes; and giving advice to data subjects in the exercise of their rights; monitoring and enforcing compliance by public and private bodies with the provisions of the PPI Act; consulting with interested parties by acting as mediator between opposing parties; handling complaints by, among others, receiving and investigating complaints about alleged violations of the protection of personal information of data subjects and reporting to complainants in respect of such complaints; conducting research and to report to Parliament from time to time on the desirability of the acceptance, by South Africa, of any international instrument relating to the protection of the personal information of a data subject; and facilitating cross-border cooperation in the enforcement of privacy laws by participating in any initiative that is aimed at such cooperation (s40 of PPI Act). IR will, in terms of PAIA, be the sole functionary, apart from the courts, to consider complaints against decisions that have been taken by public or private bodies in respect of requests for access to records of the bodies concerned.

~End~