1. Monique Jefferson & Nadine Mather

2. PROTECTION OF PERSONAL INFORMATION ACT
DATA PROTECTION IN SOUTH AFRICA
What is the current status of data protection regulation in South Africa?
Common Law
Constitution
The Protection of Personal Information Act (POPIA)
Other applicable legislation
Callout Box

3. PROTECTION OF PERSONAL INFORMATION ACT
THE POTENTIAL IMPACT ON THE EMPLOYMENT RELATIONSHIP
Potential questions relating to the employment relationship that arise as a result of the provisions of POPIA:
Is an employee entitled to ask to see a reference before it is sent to a prospective employer?
Can an employer conduct a credit record check on an applicant?
Can an employer engage a third party to conduct criminal record checks on its behalf?
Can an employer transfer employee information to its holding company in a country that does not have the same or similar data protection laws?
Callout Box

4. PROTECTION OF PERSONAL INFORMATION ACT
WHAT IS PERSONAL DATA / INFORMATION
An employee’s personal information may include, for example:
remuneration and bank account details;
medical aid number;
fingerprint for access to the employer’s premises;
performance review notes;
a set of completed job applications; or
s relating to a work incident
Do employer’s have rights under POPIA?
Callout Box

5. PROTECTION OF PERSONAL INFORMATION ACT
WHO ARE THE ROLE PLAYERS
Data subject – the Employee
Responsible party – the Employer
decides the purpose of data processing
the way in which the personal data should be processed
Operator – Third party service provider
processes personal information for a responsible party in terms of a contract or mandate
Information Regulator
Information Officer
Are any of the above role players required to register?
Callout Box

6. PROTECTION OF PERSONAL INFORMATION ACT
WHAT IS PROCESSING
Processing is anything that is done with personal information including:
collection
organisation
storage
disclosure
transmission
use
Will POPIA apply in relation to a conversation between two colleagues in respect of their views of their candidate attorney’s performance?
Would POPIA apply in a due diligence exercise where the details of employees’ remuneration is processed but the employees’ names have been redacted?
Callout Box

7. PROTECTION OF PERSONAL INFORMATION ACT
WHAT IS PROCESSING
POPIA will only apply to the processing of personal information:
entered in a record by automated or non-automated means; and
where the employer is domiciled in South Africa or is not domiciled in South Africa but makes use of automated or non-automated means in South Africa.
POPIA will not apply to the processing of personal information if:
it is for a personal or household activity;
it has been sufficiently de-identified;
it is by a public body for the purposes of national security;
it is performed by the Cabinet; or
it relates to the judicial functions of Court.
Callout Box

8. PROTECTION OF PERSONAL INFORMATION ACT
CONDITIONS FOR LAWFUL PROCESSING
In terms of POPIA, there are eight conditions for lawful processing:
Accountability
Purpose specification
Processing limitation
Further processing limitation
Information quality
Openness
Security safeguards
Data subject participation
Callout Box

9. PROTECTION OF PERSONAL INFORMATION ACT
JUSTIFICATIONS FOR PROCESSING OF PERSONAL INFORMATION
In terms of POPIA:
Can an employer conduct a credit record check without a job applicant’s or employee’s consent?
Will an employer be able to process an application for an income tax directive?
Can an employer disclose an employee’s personal information, for example their bank details, to a payroll provider?
Callout Box

10. PROTECTION OF PERSONAL INFORMATION ACT
JUSTIFICATIONS FOR PROCESSING OF PERSONAL INFORMATION
Permissible grounds on which personal information is allowed to be processed are:
consent by the employee;
the processing is necessary for contract to which the employee is a party;
there is a legal obligation to perform processing;
protection of a legitimate interest of the employee;
public law duty by a public body;
necessary to pursue the legitimate interests of the employer / third party.
Callout Box

11. PROTECTION OF PERSONAL INFORMATION ACT
SPECIAL PERSONAL INFORMATION
In terms of POPIA:
Can an employer require an employee or job applicant to undergo a medical test?
Can an employer conduct a criminal record check without an employee’s or job applicant’s consent?
Can an employer upload photos of its employees on the company website or on social media platforms?
Callout Box

12. PROTECTION OF PERSONAL INFORMATION ACT
SPECIAL PERSONAL INFORMATION
The categories of special personal information include:
Religious or philosophical beliefs
Race or ethnic origin
Trade union membership
Political persuasion
Health, sex life
Biometric information
Criminal Behaviour
Callout Box

13. PROTECTION OF PERSONAL INFORMATION ACT
SPECIAL PERSONAL INFORMATION
Processing of special personal information is prohibited unless:
the employee consents to the processing;
the information has deliberately been made public by the employee;
the processing is necessary for establishment, exercise or defence of a right or obligation in law;
the processing is necessary to comply with an obligation of international public law;
the processing is for historical, statistical, academic or scientific research;
the regulator has granted authority for the processing in the public interest and there are appropriate security safeguards in place; or
it is in accordance with the specific circumstances prescribed by POPIA.
Callout Box

14. PROTECTION OF PERSONAL INFORMATION ACT
RIGHTS OF DATA SUBJECTS
In terms of POPIA:
Is an employee entitled to ask to see a supervisor’s handwritten notes from a performance discussion?
Can an employee request an employer to make changes to a reference on the basis that it is inaccurate?
What if an employer’s HR representative mistakenly misplaces potential candidates CV’s on plane?
Callout Box

15. PROTECTION OF PERSONAL INFORMATION ACT
RIGHTS OF DATA SUBJECTS
An employee has the right to have her/his personal information processed in accordance with the conditions for lawful processing including the right to inter alia:
Be notified that personal information about her / him is being collected and/or has been accessed or acquired by an unauthorised person;
To establish whether her / his employer holds information about the employee and request access to such information (an employer may, however, refuse access based on the grounds in PAIA);
To request the correction, destruction or deletion of her/his personal information;
To object on reasonable grounds to processing of her/his personal information;
To submit a complaint to Regulator or institute civil proceedings.
Callout Box

16. PROTECTION OF PERSONAL INFORMATION ACT
TRANSFERRING INFORMATION TO OTHER COUNTRIES
In terms of POPIA:
Under what circumstances can an employer send the personal information of its employees to its holding company in a foreign country?
Can an employer store employees’ personal information on a cloud?
Callout Box

17. PROTECTION OF PERSONAL INFORMATION ACT
TRANSFERRING INFORMATION TO OTHER COUNTRIES
Transborder information transfers are prohibited unless such transfer falls within the ambit of the following exemptions:
where the receiving country has similar laws in place, or is subject to binding corporate rules or a binding agreement concluded between the sending employer and receiving employer that provides for an adequate level of protection substantially similar to that in POPIA;
the employee consents;
the transfer is necessary for performance of a contract to which the employee is a party;
the transfer is necessary for a contract in the interest of the employee; or
the transfer is for the benefit of the employee and getting consent is impractical.
Can an employer transfer medical results to its holding company in a foreign country that does not have adequate data protection laws?
Callout Box

18. PROTECTION OF PERSONAL INFORMATION ACT
STEPS TO COMPLY
Transitional period of 12 months
Review and develop standard clauses around data protection in employment contracts and workplace policies
Conduct an audit as to what personal information is held, where is it held and by whom
Establish what personal information is collected in one place and transferred to another
Develop group-wide standard data protection policies and protocols if not already in place
Establish means to comply with notification requirements
Appoint an information officer and deputy information officers for purposes of POPIA and PAIA.
Develop policies around retention
Callout Box

19. Monique Jefferson & Nadine Mather