POPI compliance: Which emails can get you into jail? Your questions answered – part 3

The Protection of Personal Information (POPI) Act has introduced sweeping changes to the way we handle data in businesses. In this webinar series hosted by BizNews founder Alec Hogg, legal experts Okyerebea Ampofo-Anti and Emma Sadleir answer questions from BizNews community members looking for clarity on POPI. This is part 3 of a series of transcripts from the BizNews webinar on POPI. The full recording is available here, too. – Editor.If we are emailing an existing client with general information related to investing. Do we have to ask their permission to send it to them or give them an opt out at the bottom of our email? .___STEADY_PAYWALL___.You don't have to ask their permission to send it to them, but you do have to give an opt out. So, unless you need that information in order for you to do your job, in order for you to fulfil your contract with that existing client, then you don't need an opt out. If it's a marketing type email, styled as 'here's some information, but actually spend more money' – then that does need to have an opt out. .Though there's an important caveat there. We're assuming that this is your business, that you do investments because one of the points under the direct marketing section of POPI is that you must market your own similar products or services. If I'm an attorney, for example, I can't suddenly decide that, 'oh, I have this friend who has this wonderful I.T. business, let me send my customer database emails because I'm getting involved in this I.T.' – that's not a similar product or service to my legal services that I offer to customers. That's an important distinction. .Can you tell us exactly and practically, how insurance brokers businesses will have to operate from the 1st of July 2020?.No, we can't – it's a very lengthy question. In insurance, you're dealing with not just personal information, you're dealing with sensitive personal information and it is one of the industries probably most affected by POPI. .You need to hire a consultant. .What about databases with existing data? i.e., Lightstone reports, the user or a subscriber does not know where they got that information from. .Well, I'm not sure exactly what she's describing, but if you've got a database where you've got a whole lot of people's information on there and you have no idea how you got that data then, and what you're going to have to do once POPI comes into force is that you're going to have to, first of all, provide privacy notices to all of the people on that database. .You're going to have to say to them, 'look, I've got your information, and this is what I plan to do with it, this is who I am, etc., you have a right to object'. All the specifications of notices under POPI are going to have to be provided to the people on the database. You're then going to have to ask yourself difficult questions like, am I entitled to process this information? Do I have what we call a lawful basis for doing so? .There are several lawful bases under POPI – consent is the magic wand. The other option is; do I have a legitimate interest in processing this? Do I have a contract with these people? So, you're going to have to look at the lawful bases under POPI and ask yourself whether you even have one. If you do not have a lawful basis for processing that information, you're not going to be able to continue using that database. You're going to have to go back from scratch and make a plan to get a lawful basis in place. .Some people have gone and got, for instance, lists straight from the shareholders list or they've gone to the Deeds office and found out how people have transferred. This has been quite big business in South Africa. Are these people going to change their operation?.Yes, they are. They are going to have to change their operations, because information is what they call publicly available, but the big trick with POPI is; the mere fact that information is publicly available does not equate to the person who made it publicly available having given you consent, and it does not equate to you, therefore, having a lawful basis for the processing. .The rest of the POPI requirements, especially finding out whether you have a lawful basis, are still going to come into effect. Depending on the nature of your business, you may well have a lawful basis that doesn't involve consent. .For example, you may have legitimate interests. POPI says even if people obtained someone's information from a public source, you still need to give them a privacy notice. You need to get in touch with all of those people and say, 'hey, I am so and so, I got your records from the Deeds office, this is what I do with it, this is how I store it etc.,' so that they can object if they have a problem with it. Or most importantly, if something goes wrong – they know where it may have gone wrong. They know that someone is holding and processing their personal information. .As a data subject, I can go to a company that I know has personal information on me and I can ask them to tell me what information they have, what they have done with the information and whether they have given it to anybody else. As a right – I'm allowed to do that at any stage..If they can't answer that, that's gonna be a problem. That's a breach. That's the kind of thing that will lead to complaints with the Information Regulator. That's what I was saying when I spoke about how POPI will change the way you deal with information, because you actually need to have some kind of systems, processes or basic understanding in place, which allows you to track and know what you do with people's information. .Who goes to jail? The information manager or the CEO/owner. .My understanding, ultimately, is that it's the information officer who will go to jail. The way the offences in POPI work is; it's got a 2 stage approach. You really, really have to be a naughty boy to get to the offence level. .The first stage is that you'll get what's called an enforcement notice from the Regulator, where they'll tell you that you are no longer allowed to do this. It is your failure to comply with the enforcement notice which becomes an offence. .Then, when you've committed that offence – that's when they're going to start talking about things like your administrative fines and your jail time. If you are a conscientious organisation that will act on enforcement notices, then you shouldn't ever have to be afraid that you will end up in the offence position. You're only going to get into the offence, because you're refusing to comply..Telecanvasing for elections, is it the same as for small businesses? .Exactly the same. There's no there's no immunity for political parties..They are going to have to ask for your consent because you're not a customer..The RBA question, which stands for risk based approach, which is required by unit trusts management..It's not the same thing. POPI is a separate piece of legislation with all of its own rules and regulations that you have to follow. Though, the risk based approach is important, because one of the things I always say to clients as well, especially with a big compliance project, is that you do need to take a risk based approach. .You can't always fulfil everything, especially if you're a small entity without a lot of resources to hire consultants and I.T. people and put up 20,000 firewalls to protect one laptop. If you don't have all of those things, you really, really have to apply a risk based approach. .And what a risk based approach is really saying, is 'OK, what are my resources? What can I achieve? And what is my risk?' Because if you're spending R10,000 that you don't have to protect yourself against a risk that may never materialise, then maybe you're better off prioritising elsewhere. .Focus on the easy wins and the things that you're able to do and work towards being able to have full compliance with some of the things that may be a lot more expensive and difficult to achieve. Of course, you need to think about balancing that. I'm not saying, oh, I don't comply with POPI at all because I don't think any of my customers will complain – that's not what I mean by risk based approach. It has to be rational..How does this affect Facebook and the data capturing?.Facebook takes the approach that they are domiciled from a jurisdictional point of view in America. The short answer is that, just like in all other spheres, my anticipation is that Facebook couldn't give a damn about POPI, like they couldn't give a damn about any other South African laws because they say they don't have jurisdiction in South Africa..Is there anything else that we can prepare ourselves for as a small business or just private individuals? .I can't emphasise enough that this is something that has to be prioritised and that you have to spend the time and do the hard slog to get on top of it. As a small business owner, the best thing you can do for yourself is to make your own little compliance timeline, say, 'OK, I'm giving myself 2 months to read up online and find out exactly how it might impact my business and then I'm giving myself another 2 months to start reviewing all of my contracts or whatever.' .If you're a bigger organisation then you can afford to bring someone else in to help you, then you could structure it differently and say, 'OK, I'm getting someone to help me at this point.' Start thinking about it today. Start putting a project timeline into place. If you're a bigger organisation – start pulling together a team which would have to have all people like your heads of department all on board and start having meetings and talking about it..Is verbal consent acceptable? .Yes. What it says about consent is it must be voluntary, specific and informed. There's no specific requirement that it has to be in writing. .The only challenge, though, is that if there's a problem later – the obligation is on you to prove it. So, if you're gonna get verbal consent make sure that it's recorded and keep your record to that later on so that you can prove it, because if you just have a conversation and someone says yes, and then later on says that they said no – how are you going to prove it? .It's not as scary as it looks. This is really quite basic. Dealing with personal information, dealing with what you can do with it, how you can keep it, making sure you don't cause harm. That's really what we've got to keep coming back to, is that this is a good thing in terms of our individual rights. It gives a lot more clarity to what our constitutional rights to privacy mean.

POPI compliance: Which emails can get you into jail? Your questions answered – part 3

Related Stories