DATA PRIVACY IN SOUTH AFRICAN LAW Brendan Hughes 2 nd International Direct Marketing Conference September 2006

Presentation Outline 1.Understanding the legal terminology 2.The purpose of data protection legislation 3.Current and anticipated data protection mechanisms in South Africa 4.Main features of the anticipated legislation from a direct marketing perspective 5.Suggested actions

1.Understanding the legal terminology “personal information” or “personal data” includes: information relating to the name, address, identity number, race, gender, reproductive status, marital status, national, ethnic or social origin, employment or criminal history, financial information, sexual orientation, age, physical or mental health, disability, religion, conscience or belief, culture, language or identifying detail assigned to a person.

Understanding the legal terminology “data subject” means the person to whom personal information relates. “consumer” means a person to whom goods or services are advertised, offered, supplied, leased, sold or delivered in the course of business.

Understanding the legal terminology “data controller” or “responsible party” means the person who determines the manner in which, and purpose for which data shall be processed. “data processor” means the person who processes personal information for the data controller or responsible party. “supplier” means a person who offers to supply or supplies any goods or services in the course of business.

2.The purpose of data protection legislation Primary purpose: To establish voluntary and mandatory mechanisms which uphold the right to privacy in an era in which technology increasingly facilitates the circulation and exchange of personal information. Opinions are divided as to how far the protection of privacy should extend.

The purpose of data protection legislation In Bernstein and Others v Bester and Others NNO (CC): “The truism that no right is to be considered absolute implies that …each right is always limited... In the context of privacy this means that it is only the inner sanctum of a person, such as his/her family life, sexual preference and home environment, which is shielded... This implies that community rights and the rights of fellow members place a corresponding obligation on a citizen…... Privacy is acknowledged in the truly personal realm, but as a person moves into communal relations and activities such as business and social interaction, the scope of personal space shrinks accordingly.” 1996(2) SA 751 (CC) at paragraph 67.

The purpose of data protection legislation Secondary purpose: To stimulate trade with EU member states. cf: Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Data.

EU Data Protection Directive The transfer of personal data to a third country for processing may take place only if the third country in question ensures an “adequate” level of protection. Without data protection legislation, personal data of EU subjects may not be processed unless contractual agreements containing appropriate data protection safeguards are in place.

In the meantime.. EU “pre-approved” contractual provisions may be incorporated into international data processing agreements.

3.Data protection legislation Currently - section 14 of the Constitution guarantees the right to privacy in addition to laws of specific application and codes of conduct. Anticipated-two new laws of general application:  Consumer Protection Bill,  Protection of Personal Information Bill, %20B%20DRAFT%20LEGISLATION.pdf

4. Main features of the new legislation Consumer Protection Bill Defines “confidential information” very broadly and gives all “personal information” confidential status. Section 13 “A supplier must not use, direct or permit any other person to use, any confidential information pertaining to a consumer or prospective consumer for, or in relation to, any promotional purpose…. unless the consumer has consented to such use…”.

Consumer Protection Bill Section 14(1) The right of every person to privacy includes the right to refuse to accept, or pre- emptively block, any electronic communication to that person where the communication is primarily for marketing goods and services. 14(2) The National Consumer Commission may establish a register in which any person may register such a pre-emptive block.

Protection of Personal Information Bill Section 9 Personal information may only be processed where the data subject has given consent thereto; where the processing is necessary for the performance of a legal or contractual obligation or where the processing is necessary for upholding the legitimate interests of a responsible party or third party to whom information is supplied.

Protection of Personal Information Bill Section 10 Personal information must be collected directly from a data subject unless contained in a public record, the data subject authorizes collection from someone else or non-compliance would not prejudice the interests of the data subject.

5.Suggested Actions Industry submissions to the legislative authorities.  Assess the manner in which your organisation handles personal information; implement or review data management processes and policies.  Consider merits of adopting industry Code of Conduct.

Suggested Actions  Assess limiting impact of new legislation on other constitutional rights, including: section 16 (freedom of expression, including the right to freely impart information) section 22 (right to trade) section 32 (right of access to limitation). A law that seeks to protect one right (section 14 - privacy) may not limit other constitutional rights in an irrational or disproportionate manner, if it does, it may be unconstitutional.

THANK YOU © Brendan Hughes, Michalsons Attorneys 2006 This document contains proprietary information that is protected by copyright. All rights are reserved. No part of this document may be photocopied, reproduced, or translated to another language without the prior written consent of the author and of Michalsons Attorneys. This document is protected by South African copyright laws and is proprietary to the author and Michalsons Attorneys. Disclosure, copying, reproduction, merger, translation, modification, enhancement, or use by anyone other than authorized employees or licensees of the author or Michalsons Attorneys without the prior written consent is prohibited. Michalsons Attorneys makes no warranty of any kind with regard to the material, including, but not limited to, the implied warranties of fitness for a particular purpose. Michalsons Attorneys shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.