Monique Jefferson Nadine Mather PROTECTION OF PERSONAL INFORMATION

Monique Jefferson & Nadine Mather

PROTECTION OF PERSONAL INFORMATION ACT DATA PROTECTION IN SOUTH AFRICA • What is the current status of data protection regulation in South Africa? • Common Law • Constitution • The Protection of Personal Information Act (POPIA) • Other applicable legislation Callout Box

PROTECTION OF PERSONAL INFORMATION ACT THE POTENTIAL IMPACT ON THE EMPLOYMENT RELATIONSHIP • Potential questions relating to the employment relationship that arise as a result of the provisions of POPIA: • Is an employee entitled to ask to see a reference before it is sent to a prospective employer? • Can an employer conduct a credit record check on an applicant? • Can an employer engage a third party to conduct criminal record checks on its behalf? • Can an employer transfer employee information to its holding company in a country Callout Boxthat does not have the same or similar data protection laws?

PROTECTION OF PERSONAL INFORMATION ACT WHAT IS PERSONAL DATA / INFORMATION • An employee’s personal information may include, for example: • remuneration and bank account details; • medical aid number; • fingerprint for access to the employer’s premises; • performance review notes; • a set of completed job applications; or • emails relating to a work incident • Do employer’s have rights under POPIA? Callout Box

PROTECTION OF PERSONAL INFORMATION ACT WHO ARE THE ROLE PLAYERS • Data subject – the Employee • Responsible party – the Employer • decides the purpose of data processing • the way in which the personal data should be processed • Operator – Third party service provider • processes personal information for a responsible party in terms of a contract or mandate • Information Regulator • Information Officer • Are any of the above role players required to register? Callout Box

PROTECTION OF PERSONAL INFORMATION ACT WHAT IS PROCESSING • Processing is anything that is done with personal information including: • collection • organisation • storage • disclosure • transmission • use Callout Box • Will POPIA apply in relation to a conversation between two colleagues in respect of their views of their candidate attorney’s performance? • Would POPIA apply in a due diligence exercise where the details of employees’ remuneration is processed but the employees’ names have been redacted?

PROTECTION OF PERSONAL INFORMATION ACT WHAT IS PROCESSING • POPIA will only apply to the processing of personal information: • entered in a record by automated or non-automated means; and • where the employer is domiciled in South Africa or is not domiciled in South Africa but makes use of automated or non-automated means in South Africa. • POPIA will not apply to the processing of personal information if: • it is for a personal or household activity; • it has been sufficiently de-identified; • it is by a public body for the purposes of national security; • it is performed by the Cabinet; or • it relates to the judicial functions of Court. Callout Box

PROTECTION OF PERSONAL INFORMATION ACT CONDITIONS FOR LAWFUL PROCESSING • In terms of POPIA, there are eight conditions for lawful processing: 1. Accountability 2. Purpose specification 3. Processing limitation 4. Further processing limitation 5. Information quality 6. Openness 7. Security safeguards 8. Data subject participation Callout Box

PROTECTION OF PERSONAL INFORMATION ACT JUSTIFICATIONS FOR PROCESSING OF PERSONAL INFORMATION • In terms of POPIA: • Can an employer conduct a credit record check without a job applicant’s or employee’s consent? • Will an employer be able to process an application for an income tax directive? Callout Box • Can an employer disclose an employee’s personal information, for example their bank details, to a payroll provider?

PROTECTION OF PERSONAL INFORMATION ACT JUSTIFICATIONS FOR PROCESSING OF PERSONAL INFORMATION • Permissible grounds on which personal information is allowed to be processed are: • consent by the employee; • the processing is necessary for contract to which the employee is a party; • there is a legal obligation to perform processing; • protection of a legitimate interest of the employee; • public law duty by a public body; Callout Box • necessary to pursue the legitimate interests of the employer / third party.

PROTECTION OF PERSONAL INFORMATION ACT SPECIAL PERSONAL INFORMATION • In terms of POPIA: • Can an employer require an employee or job applicant to undergo a medical test? • Can an employer conduct a criminal record check without an employee’s or job applicant’s consent? Callout Box • Can an employer upload photos of its employees on the company website or on social media platforms?

PROTECTION OF PERSONAL INFORMATION ACT SPECIAL PERSONAL INFORMATION • The categories of special personal information include: • Religious or philosophical beliefs • Race or ethnic origin • Trade union membership • Political persuasion • Health, sex life • Biometric information • Criminal Behaviour Callout Box

PROTECTION OF PERSONAL INFORMATION ACT SPECIAL PERSONAL INFORMATION • Processing of special personal information is prohibited unless: • the employee consents to the processing; • the information has deliberately been made public by the employee; • the processing is necessary for establishment, exercise or defence of a right or obligation in law; • the processing is necessary to comply with an obligation of international public law; • the processing is for historical, statistical, academic or scientific research; Callout Box • the regulator has granted authority for the processing in the public interest and there appropriate security safeguards in place; or • it is in accordance with the specific circumstances prescribed by POPIA.

PROTECTION OF PERSONAL INFORMATION ACT RIGHTS OF DATA SUBJECTS • In terms of POPIA: • Is an employee entitled to ask to see a supervisor’s handwritten notes from a performance discussion? • Can an employee request an employer to make changes to a reference on the basis that it is inaccurate? Callout Box • What if an employer’s HR representative mistakenly misplaces potential candidates CV’s on plane?

PROTECTION OF PERSONAL INFORMATION ACT RIGHTS OF DATA SUBJECTS • An employee has the right to have her/his personal information processed in accordance with the conditions for lawful processing including the right to inter alia: • Be notified that personal information about her / him is being collected and/or has been accessed or acquired by an unauthorised person; • To establish whether / his employer holds information about the employee and request access to such information (an employer may, however, refuse access based on the grounds in PAIA); • Callout Box To request the correction, destruction or deletion of her/his personal information; • To object on reasonable grounds to processing of her/his personal information; • To submit a complaint to Regulator or institute civil proceedings.

PROTECTION OF PERSONAL INFORMATION ACT TRANSFERRING INFORMATION TO OTHER COUNTRIES • In terms of POPIA: • Under what circumstances can an employer send the personal information of its employees to its holding company in a foreign country? • Can an employer store employees’ personal information on a cloud? Callout Box

PROTECTION OF PERSONAL INFORMATION ACT TRANSFERRING INFORMATION TO OTHER COUNTRIES • Transborder information transfers are prohibited unless such transfer falls within the ambit of the following exemptions: • where the receiving country has similar laws in place, or is subject to binding corporate rules or a binding agreement concluded between the sending employer and receiving employer that provides for an adequate level of protection substantially similar to that in POPIA; • the employee consents; • the transfer is necessary for performance of a contract to which the employee is a party; • the transfer is necessary for a contract in the interest of the employee; Callout or • the transfer is for the benefit of the employee and getting consent is impractical. Box • Can an employer transfer medical results to its holding company in a foreign country that does not have adequate data protection laws?

PROTECTION OF PERSONAL INFORMATION ACT STEPS TO COMPLY • Transitional period of 12 months • Review and develop standard clauses around data protection in employment contracts and workplace policies • Conduct an audit as to what personal information is held, where is it held and by whom • Establish what personal information is collected in one place and transferred to another • Develop group-wide standard data protection policies and protocols if not already in place • Establish means to comply with notification requirements • Appoint an information officer and deputy information officers for purposes of POPIA and PAIA. • Develop policies around retention Callout Box

Monique Jefferson & Nadine Mather