1. Tools & Approaches for Ongoing Privacy Compliance
Pria Chetty
Chetty Law

2. News Headlines

3. 1 CCTV May not record conversations Information Commissioner
Rights of members of public vs Right to protect property

6. 2

7. 3 Lost a disk with details 370 000 policy holders
Password protected but not encrypted
Post
Norwich million pounds
(controls)
Nationwide
pounds
(laptop stolen)

8. Dissecting the Compliance Nightmare/ Legislative Scoping

9. Corporate Governance

10. Information Assets

11. Legislation/Statutes (E)
Compliance Mind Map
Legislation/Statutes (E)
Regulations (E)
Standards (E/I)
Policies (I)
Guidelines (I)
Codes (E/I)
Charters (E/I)

12. Privacy Compliance
King II Code
ECT Act
Companies Act
EC Act
RIC Act
PAI Act
King II Code ECT Act RIC Act PAI Act PPI Bill Consumer Protection Bill National Credit Act Consumer Protection Act Intellectual Property Legislation

13. Electronic Communications and Transactions Act 25 of 2002

14. Section 11
… Information is not without legal force and effect merely on the grounds that it is wholly or partly in the form of a data message… or is merely referred to in such data message…

15. Sufficiently Secure Payment Systems
…where a payment system was insufficiently secure, the supplier is required to compensate the consumer for any loss suffered…determined in accordance with the nature of transaction and technological standards applicable… …

18. Cyber Crime
…unauthorised access to, interception of, or interference with data, (computer-related extortion, fraud and forgery…and aiding and abetting… …

19. The Constitution

20. Section 14(d) of the Constitution
“14. Everyone has the right to privacy, which includes the right not to have-
(d) the privacy of their communications infringed.”… …

21. Section 36 of the Constitution
… The rights in the Bill of Rights may be limited only in terms of law of general application to the extent that the limitation is reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom, taking into account all relevant factors, including… …

22. National Credit Act: Information Privacy

23. National Credit Act/ s 68
a right to confidential treatment of ‘confidential information’ received, compiled, retained or reported in terms of the Act …

24. National Credit Act/ Confidential Information/s 1
‘personal information that belongs to a person and is not generally available to or known by others’ …

25. National Credit Act/ s 68
confidentiality of such information must be protected by its holder and must be used only for a lawful purpose, must be disclosed only to the person to whom it relates or to a third party where required by law, by court order or order of the Consumer Affairs Tribunal created by the Act or ‘as directed by ... the instructions of the consumer’

26. Consumer Protection Bill

31. Compliance Health-check

35. Statement of Compliance/ Policies

36. Website Privacy
Policy

37. Instant Messaging
Policy

38. PPI Bill/ Suggested Compliance Methodology

39. 1 Define the Organisation Legislative/ Regulatory Environment Industry
Media/
Technology Profile

40. 2 Mapping Information Lifecycle collection, maintenance,
security, use,
disclosure
multi disciplinary

42. What information is the organisation receiving from third parties?
How is information collected
What information is moving
intra-departmentally?
What information is moving from the
organisation to third parties?
What information is moving cross border?

43. Classification of Information3
Classification of Information
Personally
Identifiable
Anonymised
Sensitive
Categories & Format

44. 4 Specific Questions (Principles) Collection
What information is collected without
a user’s explicit knowledge and/or consent?

45. 4 Specific Questions (Principles) Data Integrity
Is there a mechanism in place to allow users
To access to their information?

46. 4 Specific Questions (Principles) Security Identification,
Authorisation,
Access

47. Privacy Documentation:
Agreements/ Policies 5
Review Policy
Training & Awareness

48. Ongoing Compliance 6
Impact Assessment
Template
Update Policies

49. Online Resources

54. Pria Chetty pria@chettylaw. co. za 011 463 6368 083 384 4543 www
Pria Chetty

55. New Website Launch Date: 15/04/09
New Website Launch Date: 15/04/09