Put your left leg in, put your left leg out: the exclusions and exemptions of the Protection of Personal Information Bill explained - Neil Kirby, Werksmans Attorneys
Put Your Left Leg In,Take Your Left Leg Out: The exclusions and exemptions of the Protection of Personal Information Bill explained Neil Kirby
PROTECTION OF PERSONAL INFORMATION BILL1. Objects & purpose - constitutional right to privacy - processing regulation - rights & remedies to protection personal information - voluntary & compulsory measures to enforce rights2. Section 14 “Everyone has the right to privacy, which includes the right not to have – (a) their person or home searched; (b) their property searched; (c) their possessions seized; or (d) the privacy of their communications infringed.”3. But also sections 7, 10, 12(2), 15(1), 19 and 21 of the Constitution.
CONSTITUTIONAL PREROGATIVES“As a general rule any person is likely to feel violated, harmed and invaded by the publication of unlawfully obtained information. Any reasonable person would probably feel less concerned if his discussion of an upcoming metropolitan council election, or the state of the global economy, were unlawfully intercepted and subsequently published, than if his discussion of intensely private matters such as family disputes or medical records were illegally intercepted and published for a larger audience. Similarly, on the public interest side of the equation, the public will certainly be interested and accordingly benefit from discussion of matters which are clearly in the public interest.” See Tshabalala-Msimang and Another v Makhanya and Others 2008 (6) SA 102 (W) at paragraph 35
“PUBLIC INTEREST”“Public interest, it must be noted, is a mysterious concept, like a battered piece of string charged with elasticity, impossible to measure or weigh. The concept changes with the dawn of each new day, tempered by the facts of each case. Public interest will naturally depend on the nature of the information conveyed and on the situation of the parties involved. Public interest is central to policy debates, politics and democracy. While it is generally acclaimed that promoting the common wellbeing or general welfare is constructive, there is little, if any, consensus on what exactly constitutes the public interest.” See Tshabalala-Msimang decision at paragraph 36
RIGHT HOW?“The public has the right to be informed of current news and events concerning the lives of public persons such as politicians and public officials. This right has been given express recognition in section 16(1)(a) and (2) of the Constitution, which protects the freedom of the press and other media and the freedom to receive and impart information and ideas. The public has the right to be informed not only on matters which have a direct effect on life, such as legislative enactments and financial policy. This right may in appropriate circumstances extend to information about public figures.” See Tshabalala-Msimang decision at paragraph 37
REALLY?!“This is a case where the need for the truth is in fact overwhelming. Indeed in this matter the personality involved, as well as her status, establishes her newsworthiness. Here, we are dealing with a person who enjoys a very high position in the eye of the public and it is the very same public that craves attention in respect of the information that is in the hands of the Sunday Times. The overwhelming public interest points in the direction of informing the public about the contents incorporated in the medical records in relation to the first applicant, albeit that the medical records may have been unlawfully obtained. In these circumstances I am unable to accede to the requests of the applicants with regard to paragraphs 3 and 7 of their notice of motion which in effect would impose a form of censorship in relation to any future publication around the medical record. See Tshabalala-Msimang decision at paragraph 49
“THE PRIVACY DEBATE”“However this story does go to show that the privacy debate around the smartphone is entering the mainstream consciousness, and that’s something Facebook, and the rest, will have to deal with. Especially in privacy-obsessed Europe.” M Butcher “Facebook Accused of Reading User’s Text Messages” at http://techcrunch.com/2012/02/26/facebook-accused-of-reading-users- text-messages/
POPI LANDSCAPE1. Application2. Exemptions3. Exclusions4. Only 5th draft: not clear but landscape is not expected to change: three pronged inquiry • Does it apply to me and my data? • If so, am I or my data or both exempt? • If not, do I or my data or both fall into an exclusion?
APPLICATION1. Interpretation • give effect to objects and purpose • does not prevent “exercising or performing its powers, duties and functions in terms of the law …” v “processing”2. “processing personal information” • entered in a record • responsible party • domiciled in Republic • automated or non-automated means in Republic3. Hierarchy of legislation
EXCLUSIONS I• Section 6• Also section 5: “lawful processing of personal information”; accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, data subject participation• CATEGORY DEDICATED INFORMATION EXLUSION SECTION PRINCIPLES APPLICABLE Children 25(1) to 26(a) to (e) Apply Yes Special personal Various: 25(2) to 32 Apply Yes information Direct marketing 71 Apply yes • Exclusion test: o What is the information about? o Do I follow the principles? o Am I excluded by section 6? o Do I have a Regulator exemption for my data?
EXCLUSIONS II• household activity• de-identified “to the extent that [the data] cannot be re- identified again”• public body involving national security, public safety• public body for preventing crime• “exclusively journalistic purposes” (currently subject to 5 options)• Cabinet and its committees• provincial executive council• judicial functions of a court• Regulator exemption in terms of section 34
EXEMPTIONS I • Difference: exemptions attach to categories of information and are particular as opposed to exclusions, which operate generally • CATEGORY EXCLUSION PROCESSOR INFORMATION Children Yes Consent Religious or philosophical Yes Certain institutions beliefs Race or ethnic origin Yes Essential purpose & BEE Trade union membership Yes Trade union Political opinions Yes Political party
EXEMPTIONS II CATEGORY INFORMATION EXCLUSION PROCESSOR Health or sexual life Yes Medical professions in confidence and insurance companies, medical aid schemes, medical aid scheme administrators, managed healthcare organisations, schools, Minister of Correctional Services, pension-related persons, Minister of Justice Criminal behaviour Yes 1. Law enforcement bodies 2. “responsible parties who process the information for their own lawful purposes …”(?) Special personal information Yes 1. Consent 2. Regulator exempt 3. One of categories in section 26 DNA Yes 1. Serious medical condition prevails 2. Historical, statistical or research activity
REGULATOR• Section 34: authorises a responsible party to process otherwise protected information• Regulator must assess circumstances: any one or more of the following – “public interest” outweighs privacy; OR “a clear benefit” to data subject or a third party outweighs privacy• “public interest” national security crime important economic or financial interest of public body international or national interests historical, statistical or research activity• Conditions may be imposed
SO WHAT?1. Compliance2. Complaints3. Investigations by Regulator: onerous4. Search & seizure5. Assessments in relation to compliance6. Information notices: determine interference7. Enforcement notice: interfered8. Fines