State of readiness to implement remaining sections of POPIA: Information Regulator briefing

Meeting report

The Chairperson said that the Committee would be briefed by the Information Regulator (IR) on its state of readiness for the implementation of the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA).  

IR Chairperson's opening remarks

Adv Pansy Tlakula, Chairperson of the Information Regulator, said that the process of implementing POPIA had served as a steep learning curve for the IR and the institutions/organisations that were expected to comply with the Act. The IR had developed a number of standard setting documents, which seek to guide responsible parties on how to comply. Whilst implementing some of the documents, the IR had noted that some of them had to be amended, due to the unintended consequences that had emerged.

The Regulator had also noted that institutions that had applied for compliance, and those that were seeking to apply for compliance, had been battling to interpret sections of the Act. Officials at the Regulator anticipated that they would encounter difficulties for the first year of implementation.

State of readiness for implementation of POPIA and PAIA

The Committee was presented a report on the IR’s state of readiness for the implementation of the POPIA and PAIA. The report was presented by Mr Mosalanyane Mosala, the Acting Chief Executive Officer (CEO) of the IR, Ms Nomzamo Zondi, the Senior Manager of Communications, and Ms Varsha Sewlal, Executive: Legal, Policy, Research and Information Technology.

They said that POPIA came into effect on 1 July 2020, except for Sections 110 and 114(4), which would be effective on 30 June 2021. All responsible parties were required to put in place measures to ensure that all processing of personal information was in compliance with POPIA during the current 12-month grace period. From 30 June, the IR would be responsible for the promotion and enforcement of the rights protected by PAIA. This function was currently performed by the South African Human Rights Commission (SAHRC).

To ensure that the operating environment was prepared to effectively promote and protect the right to privacy, as well as the right of access to information, the Regulator had developed a readiness plan for the implementation of both POPIA and PAIA. This readiness plan looked at the organisation’s capacity to successfully deliver or to perform its functions under POPIA and PAIA. The plan had identified the updating of the PAIA guide (which was initially compiled by SAHRC) as a critical action, and thus far, it was in the advanced stage of translating the guide into all 11 official languages.

The Regulator viewed an automated complaints management system as necessary, but as it was yet to be allocated funding, complaints would be handled manually. Key to the uptake of complaints would be the information officers. Recognising this, the regulator had decided to issue a guidance note on the registration of the officers on an online portal. The portal had been developed and was currently being refined by the Department of Justice and Constitutional Development (DoJ&CD).

While progress had been made thus far, the regulator had encountered challenges during the process, but it was confident that it would be able to fully implement and enforce both Acts.

Adv Tlakula mentioned that the Board had decided that the Enforcement Committee would be chaired by a retired judge, as they were mindful of the workload of current judges. Discussions with potential candidates were currently under way.

The Chairperson opened the floor for discussion.

Discussion

Mr W Horn (DA) said that while he appreciated the steps taken by the IR to ensure that it was prepared for the handover on 1 July, he was also concerned that it would not manage to effectively deal with the number of complaints it was bound to receive. Many of the complaints the Regulator would receive would be related to the protection of their personal information.

It had been reported that the online portal was currently being refined by the DoJ&CD. This could be interpreted as being that it was not yet ready to be launched. It was vital that the Department operationalise the online portal, so that compliance officers were registered on the system, as the officers would be responsible for the taking up of complaints on irregular behaviour by alleged institutions and entities.

He pleaded with the regulator to establish a plan which would both service and instil confidence in South Africans. Furthermore, the regulator should be even-handed when dealing with each complaint made against a particular institution. Communication would be key to this.

Ms N Maseko-Jele (ANC) said that the Regulator’s ability to handle complaints would be important. Its independence and its listing would also be key, as both would provide it with the opportunity to fully implement its strategy. She asked for a progress update on the talks between the Regulator and the Minister of Finance on its separation’s strategy.

Referring to Parliament’s concerns around Facebook and the extent to which the South African public’s digital privacy was being protected, she said that in previous discussions, the Regulator had indicated that it had sought legal opinion on collaborative efforts between SA and other countries regarding this matter. She asked if there had been progress on the issue.

There had been notable progress in the filling of vacancies at the IR, and the Committee should applaud them for this. The filling of vacancies would ensure that there was capacity to implement the work at the Regulator. It would also inspire more individuals to want to be involved in the work of the IR.

Ms W Newhoudt-Druchen (ANC) requested that the regulator place a sign language officer in all its televised and uploaded videos, to ensure that the deaf community was as aware as other communities on issues relating to data privacy.

She asked whether there were risks attached to the non-implementation of both Acts by 1 July. If there were, did the Regulator have a mitigating strategy?

Ms Maseko-Jele asked whether the Regulator had ensured that all of the information in its documents were translated into all languages, including marginalised languages, such as the San language.

IR's response

Adv Tlakula delegated which of the officials would be responding to the questions posed.

Adv Lebogang Stroom, IR Board member, confirmed that during the grace period the Regulator had received complaints and inquiries, and it was working to ensure that it was able to deal with all PAIA complaints. It was currently dealing with outstanding complaints that needed to be resolved before the Act was in force.

Referring to the automated complaints management system, she said that a budget was yet to be allocated. As the system would not be ready by 1 July, the Board had suggested that in the meantime, the DoJ&CD provide the complaint’s form online, and each complaint should be handled manually. Another challenge was the lack of personnel. However, recruitment was currently under way and there were planned interviews for compliance officers in the coming week.

The Chairperson mentioned that due to a security risk, the meeting would be temporarily adjourned whilst a new link to the meeting was being generated.

Prof. Sizwe Snail ka Mtuze, a part-time member of the IR Board, said that in light of the regulations, the IR would ensure that marginalised languages, such as the Khoisan language, were catered for. The Regulator had also had discussions with the deaf community in Cape Town, and various other organisations, to ensure that they were given the attention that they deserved. 

Adv Stroom said that the regulator had had a meeting with the SAHRC, led by its CEO, where they had discussed several issues, one of which was the plan of action for the handover of PAIA functions. Both parties had reached two agreements. The first was that the SAHRC was willing to complete and close all outstanding PAIA-related complaints by 30 June, so that there would be no rollover. The second was that the IR would take over the database of all current stakeholders, but the SAHRC must ensure that the stakeholders were compliant with POPIA before the handover was done. 

Ms Sewlal said that during this transitional period, the SAHRC would continue to collate the Section 32 reports for the 2020/21 financial year. It would also submit the 2020/21 annual PAIA report.

Adv Tlakula said that in terms of Section 57 of POPIA, responsible parties who processed information regarded as being high risk, would have to obtain prior authorisation from the IR. This guidance note had been published by the IR and since then, the entity had received nearly 60 applications for prior authorisation, of which two referred to codes of conduct. It was currently considering all applications. Many of the applications pointed to the challenges applicants faced with the interpretation of the Act. This would not be a smooth sailing process, as there was no precedent in some of the matters.

The Chairperson mentioned that the Committee would write to the House Chair on convening a sitting with the other committee’s that were currently dealing with Facebook and WhatsApp matters, so that a joint resolution could be reached.

He proposed that the Committee organise a sitting with the Regulator once it returned from recess, so that it could ascertain what issues the Regulator faced with the implementation of POPIA and PAIA, and any other challenges it had encountered. In addition, the Committee would schedule meetings at regular intervals with the Chairperson of the IR, so that she could inform the Committee on what assistance the Regulator may require.

As a new entity, the IR had the opportunity to ensure that its appointments included more women, people with disabilities and youth. The IR should show South Africans what an entity should look like.

He thanked the officials for their input at the meeting.

Adv Tlakula requested that the Committee provide them with the support they needed, going forward.

Adoption of minutes

The Committee considered and adopted its minutes for 14, 20, 21, 25, 26, 28 and 29 May 2021.

Committee programme

The Chairperson said that the Legal Practice Council proposed to sit with the Committee on 8 June 2021. He asked if Members agreed with the proposal to meet on that date.

Ms Maseko-Jele supported the proposal.

Adv G Breytenbach (DA) seconded.

The Chairperson said that on the following day, the National Assembly would debate the three gender-based violence (GBV) Bills and subsequently adopt the report of the SAHRC.

The meeting was adjourned.