Bill's Private Proposal

<<More Articles>>

Protection of personal information – Part 2

The very first thing that needs to be said is that the Protection of Personal Information Bill has no connection whatsoever to the Protection of Information Bill. This is just another case of, “If it wasn't confusing, it wouldn't be South African politics.” Here's a short run-down on these two Bills with similar-sounding names.

The Protection of Information Bill, over which there is deservedly much noise and protest, deals with “State Secrets” and the media. It is mostly a pretty blatant attempt by the government, to curtail our Constitutional rights to freedom of speech, freedom of expression, freedom of publication, and free access to information.

The Protection of Personal Information Bill, on the other hand, deals only with the collection, storage, transmission and use (processing) of personal information. For example, when your bank collects your personal information with the purpose of opening a savings account, what are the laws and guidelines that control its use of that information?

In Part One (Mine, Mine, Mine …) I focused on the vital importance of legislating the processing of personal information as a primary raw material of the Information Age.  We are already experiencing how lack of such legislation is resulting in elevated costs and inconvenience due to such things as spam emails and computer spyware. History has also clearly shown that continued lawlessness will create many, as yet unforeseeable, future problems. Human greed always requires boundaries, and the greed of powerful humans requires powerful boundaries in the form of laws. We can be certain that where human greed focuses on personal information, that our constitutional rights to ownership, privacy, information access, and personal safety are certain to be violated. In fact, these constitutional rights are already being violated due to the current lack of personal information legislation.

Prior to the 2010 FIFA World Cup here in South Africa, pressure was placed upon government and the various organising bodies to formulate legislation protecting personal information. The result of this pressure is the proposed Protection of Personal Information Bill. (spoken of subsequently as The Bill) The Bill was formulated by the Department of Justice and published in the Government Gazette in August 2009, but unfortunately, since then, seems to have stalled. The Bill recognises and legislates our Constitutional rights to privacy, but does not yet specifically and legally recognise personal information as an “own-able” raw material. This means that although it gives me more control over how my information is used, I can neither charge for the use of my private information, nor have absolute control over who collects it. However, The Bill is most definitely a huge move in the right direction.

It is merely a matter of time until The Bill is promulgated. When that occurs, any company that processes personal information in any way, and for any reason, will need to ensure that they do so in accordance with The Bill. According to The Bill, this includes most organisations. Even a plumber who acquires a client's phone number and address in order to complete a single specific task is processing information. I recommend that organisations immediately begin the process of setting up the human resources, training, security, and work-flow structures that will be required by The Bill. For your edification and convenience, I've identified seven areas that will need attention, and have included some insights into what each requires.

1.      Accountability

Who, within the organisation, is responsible for ensuring compliance with The Bill?

Each organisation must appoint an Information Protection Officer (IPO), who must ensure that the company complies with all aspects of The Bill. Depending on the size of the business, the IPO could be just a title and responsibilities added to an existing employee's job description, an employee dedicated to this task and function, or even an entire department.

According to The Bill, the IPO will be responsible for ensuring compliance, for creating the necessary structures, and culture within an organisation to ensure proper processing of personal information, and for reporting to the government-appointed Regulator.

2.      Processing Limitation

Information must be processed in a fair and lawful manner.

“Processing” applies to any and all aspects of data collection, storage, use, access, and/or transmission.

  • Information processing may not infringe upon the privacy of the individual.
  • Only the minimum amount of information required for the specific task at hand may be collected.
  • The explicit consent of the individual from whom the information is collected is required.
  • Information may only be collected directly from the individual concerned.

The watchwords for personal information processing are openness and transparency.

3.      Purpose Specification

What is the specific purpose for which the personal information is being processed?

Personal information may only be used specifically for the purpose for which it is collected. For example, if your information is given to your bank specifically to open an account, that information may not be used by the bank's marketing department.

Organisations must therefore ensure that:

  • Personal information is processed only for specifically defined, legitimate reasons that relate directly to the business.
  • The individual is aware of the processing and purpose of the information.
  • Information is only kept for as long as is absolutely necessary to the purpose for which it was collected.
  • Specific, further consent from the Individual is acquired for any processing of personal information that goes beyond the originally stated purpose.

This means that every organisation will have to have a clear knowledge and record of all the various sources and reasons for personal information processing within the organisation. This applies equally to staff and client information.

4.      Information Quality

Organisations are responsible for maintaining the quality of all information in their possession. The onus for information quality lies not with the information target – i.e. individual client or employee – but with the organisation that processes the information.

Information quality includes both the accuracy and completeness of personal information, as well as ensuring that all personal information is up-to-date and not misleading. This means that organisations must continually assess and evaluate all information in their possession.

5.      Openness

All information must be processed in an open and transparent manner. This means that all individuals must be specifically aware of any personal information held by any organisation. Additionally, any organisation that processes personal information in any way, must notify both the “Regulator” and the “Individual”.

As regards notifying the Regulator:

All organisations that process personal information in any way, must notify/register with the Regulator. This notification must include:

  • information about the notifying business
  • the type, purpose, and usage of all personal information to be collected
  • profiles of the types of individuals from whom the information will be collected
  • details of any other parties to whom this information might be supplied
  • whether the information will leave the country, and for what purpose
  • details of security arrangements for the information to be processed

The Regulator will have to be informed about any changes in the above information within one week of the change.

As regards notifying the Individual:

No personal information may be collected without prior notification of, and consent from the individual in question. This is true even for situations in which the individual is required to provide personal information by law.

This notification must include:

  • the specific reason/s for processing the information
  • information on the individual's rights concerning the information that they've provided

6.      Information Security

All personal information must be kept secure against any risk of loss and unauthorised access, interference, modification, destruction, or disclosure.

  • Firstly, organisations that process personal information must ensure that they implement, and regularly re-assess their data security features in order to protect personal information in their care. While the Bill does not specify security methods, it does expect that international data security standards will be adhered to.
  • Secondly. If an organisation uses a third party to process personal information on its behalf, the organisation retains full responsibility for that personal information, and for all compliance with the Bill.
  • Finally, organisations have a responsibility to notify both the Regulator, and all affected individuals in the event of any security breach relating to personal information processing.

7.      Individual Participation

An individual can, at any time, access and request the correction or deletion of any personal information held by an organisation, that may be inaccurate, misleading or outdated. Organisations are also bound to reply to all queries from individuals as to whether they hold any information concerning the individual, along with any and all details relating to the processing of that information. This is in respect of the individual's Constitutional rights to Privacy, and Access to Information.

At first glance, it might seem that The Bill creates only extra work and expense. However, on further consideration, the necessity for such legislation becomes quite obvious, even if no less initially frustrating. In my first article on the protection of personal information (Mine, Mine, Mine, Mine), I spoke of the vast changes and chaos that ensued when materials such as coal and iron became high-demand raw materials at the start of the Industrial Age. Legislation concerning these raw materials no doubt created extra expense and effort for businesses of the time. However, with the benefit of historical hindsight, we no longer even question the need for those raw material ownership and control laws.

So, with that in mind, take a step back and consider calmly and clearly what is needed to bring a semblance sanity to the processing of personal information, the primary, high-demand raw material of our new Information Age.


Author: Robin Bownes