Mr Speaker and hon members, it was during the deliberations on the Open Democracy Bill in 2000 that our Parliament first identified the need for legislation to be enacted to regulate the processing of personal information. Two pieces of legislation were enacted that year as a result of the work of the ad hoc Joint Committee on the Open Democracy Bill, namely the Promotion of Access to Information Act of 2000 and the Protected Disclosures Act of 2000.
When the ad hoc committee reported the Promotion of Access to Information Bill to Parliament, it pointed out, among other things, that:
The Bill only deals with the aspect of access to private information of an individual, be it access by that individual or another person, and did not regulate other aspects of the right to privacy, such as the correction of and control over personal information and so forth.
The ad hoc joint committee further highlighted that other jurisdictions with access to information legislation had also enacted separate privacy and data protection legislation, and therefore recommended that our country should follow the same approach after the necessary research had been conducted. The Bill before us today emanates from the SA Law Reform Commission's Report on Privacy and Data Protection. In our country the right to privacy is protected both in terms of our common law and section 14 of our democratic Constitution. The recognition and protection of the right to privacy as a fundamental human right in our Constitution provides an indication of its importance. Data or information protection forms an element of safeguarding a person's right to privacy. It entails the right of the individual to be protected against the unlawful collection, retention, dissemination and use of his or her personal information.
The right to privacy is of course not an absolute right, but may be limited in terms of law of general application and must be balanced with other rights that are entrenched in our Constitution. In protecting a person's personal information, consideration should also be given to competing interests such as the administering of national social programmes, maintaining law and order and the protection of the rights, freedoms and interests of others. It should also be recognised that the state has a responsibility in terms of section 7(2) of the Constitution to respect, protect, promote and fulfil the rights in the Bill of Rights.
Information technology is becoming an ever-increasing, crucial and integral part of our daily lives in the world. The expansion of telecommunications technology has led to an information explosion and has increased opportunities for information collection. We live in the age of the Internet, the Worldwide Web and smart phones. It is important that we should ensure that the timeless privacy values that we have always subscribed to should also apply to these new circumstances.
Important decisions are being taken every day based on information that may sometimes be incorrect, inaccurate and untrue. Information may also be outdated or be confused with someone else's. As a result of incorrect, inaccurate or false information, individuals could find themselves unfairly refused employment, housing benefits, credit or even admission to institutions of higher learning. It should also be recognised that unprotected personal information may even lead to identity theft, credit card fraud, stalking, the proliferation of unsolicited pornography, spam and marketing manipulation excesses.
I therefore wish to emphasise that information privacy can also not simply be regarded as a domestic policy problem. The increasing ease with which personal information can be transmitted outside the borders of our country of origin has led to many international harmonisation efforts and a concomitant effort to regulate transborder information flows. Privacy is therefore an important trade issue, as information privacy concerns can create a barrier to international trade and the free flow of information.
Considering international trends and expectations, information privacy legislation will ensure our country's future participation in the information market, if it is regarded as providing adequate information protection by international standards.
I do not want to deal with all the clauses of the Personal Information Bill, save to say that clauses 4 and 5, that have been included in this Bill, were as a result of the good work that was done by the technical committee assigned by the portfolio committee to consider this Bill.
Allow me briefly to interrupt myself at this stage to thank members of the technical committee, Ms Smuts, Dr Oriani-Ambrosini and Mr Jeffery, who was the chairperson of this technical committee, for the efficient manner in which they executed their task and for all the hard work that has come about. [Applause.] Thank you.
One of the important inclusions by this technical committee is the issue of the Information Regulator, which will be established as an independent statutory authority with a maximum of five members, including the chairperson of the regulator. Since the processing of personal information is closely related to the promotion of access to information, it has been decided to afford the Information Regulator certain powers, duties and functions in terms of the Promotion of Access to Information Act.
I would like to take this opportunity to thank all members of the portfolio committee who have shown a deep commitment to ensuring that this end product, which reflects the views and norms of the people they represent, is in line with our policy as government and that it is practicable.
In conclusion, I would like to point out that I am convinced that this legislation is essential for purposes of regulating the manner in which personal information must be processed. I look forward to your support in approving this Bill. [Applause.]
Speaker, hon members, the first thing I was told to say in this debate is that this Bill has nothing to do with the Protection of State Information Bill. It is a different Bill. It deals with the privacy of personal information.
This Bill was introduced in Parliament in 2009 and went to the National Assembly. It is by far the oldest Bill in Parliament. As the Minister said, it owes its origin to a report of the Ad Hoc Committee on the Open Democracy Bill, which was passed as the Promotion of Access Information Act, commonly known as Paia. That report was adopted by this House in early 2000.
The original Open Democracy Bill that had been introduced had some sections dealing with personal information. The ad hoc committee dealing with the Bill had felt that those would be better placed in separate legislation. As the Minister reported, it requested the then Minister to introduce privacy and data protection legislation, after thorough research. The ad hoc committee also noted that when that privacy and data protection legislation is passed, it may be necessary for the Promotion of Access to Information Act to be amended in accordance with the data protection legislation.
The Bill was then introduced after a thorough investigation by the SA Law Reform Commission. I must say that it is not an easy piece of legislation. In my 13 years in this House, I think it is the most complicated piece of legislation that I have been involved in.
As members would have seen, the Bill - it is being distributed now - has 115 sections and then an additional 20 pages of schedule, which are mainly amendments to the Promotion of Access to Information Act, but also to some other pieces of legislation. So, it is a very complicated piece of legislation. It deals with the rights of personal privacy and, obviously, balancing those rights against the rights of freedom of expression.
The reason the Bill has taken so long is because of this complexity and the enormous amount of work that had to go into it. We were on the ninth draft of the Bill before we produced the B version which is currently before the House. We had public hearings. There were some 36 submissions, oral and written. The portfolio committee conducted a study trip to the United Kingdom, sponsored by the Open Democracy Advice Centre, to meet with the United Kingdom Information Commissioner and other experts.
As the Minister said, a technical committee was established to consider most of the issues. Then the Bill was referred back to the full committee, which also deliberated on the Bill in a number of meetings. I haven't tried to work out the exact number of meetings that were conducted in total or the number of hours that we sat, but it was extensive.
More than 50 countries in the world, including six on the African continent - Angola, Benin, Burkina Faso, Mauritius, Morocco and Senegal - already have legislation dealing with the protection of personal information. Some have had it for some time. In the European Union, where members have had such legislation in effect for some time, a revision has been taking place. This resulted in an EU draft regulation that will be applicable to all countries in the EU.
In dealing with the Bill before us, particularly over the time that we have had it, we have been able to learn from other countries' experiences and have effected amendments to the Bill currently before the House; amendments to make the Bill more practical and more effective.
We have engaged with and been assisted by numerous stakeholders, and we had to grapple with a range of issues, including those that ensured that the Bill did not unduly restrict journalists. In this regard, we had a couple of meetings with the SA National Editors' Forum. We had to ensure that the Bill did not unduly restrict bloggers or so-called citizen journalists, law enforcement agencies, children on Mxit, and literary or artistic expression.
The Bill has often been misunderstood as creating a range of crimes for the wrongful processing of personal information. This is not the case. What the Bill does is to establish a set of conditions for the processing of personal information. These include both general conditions and more detailed conditions for the processing of special personal information such as religious or philosophical beliefs, race and ethnic origins and political persuasion, to name a few.
The Bill then establishes an independent Information Regulator to regulate the implementation of the law. This implementation includes not only education and research, but also monitoring and enforcing compliance and handling complaints. Sectors are encouraged to regulate themselves by drawing up codes of conduct for the processing of personal information that must be approved by the regulator. For example, we have granted exemption to journalists, subject to a code that sufficiently covers the relevant issues. The media is then left to regulate itself, subject to that code. With a few exceptions, crimes are only committed when a party does not abide by an enforcement notice issued by the regulator. An aggrieved party has the right to take the enforcement notice on appeal to the High Court.
So, basically, the way the Bill works is: These are the conditions; if there is a complaint, you go to the Information Regulator. If the Information Regulator rules against you, you then have to comply. Only if you don't comply or appeal to court and continue to process the information would you be guilty of a crime.
One crime, however, that we did create was the unauthorised processing of bank account numbers. This was in response to a growing problem of bank account numbers being freely available and people being approached to buy products just to find that their bank accounts were debited for goods or services that they had not agreed to, because the people offering those services already had their account numbers. When the Bill becomes a law, that will become a crime. It will not be something to complain to the Information Regulator about.
As this House envisaged back in 2000, the Bill did forsee changes to the Promotion of Access to information Act because the responsibilities for the implementation of the Act were being transferred from the SA Human Rights Commission to the Information Regulator. The committee also took the opportunity to make certain amendments to Paia that had not been achievable, such as the requirement that a hard copy of a Paia manual had to be submitted to the Human Rights Commission - or now the Information Regulator. That will no longer be a requirement. Copies of the manual that is meant to be produced will be kept by the relevant bodies and only submitted on request.
As far as I am aware, this Bill is being supported by all parties on the Justice committee. I would like to thank the members of the technical committee, in particular, for their hard work - hon Smuts and Oriani- Ambrosini. I also want to give special thanks to Mr Henk du Preez of the department and Ms Ananda Louw of the SA Law Reform Commission for their devotion to duty in effecting the amendments that the committee wanted. The nine drafts of the Bill that I was speaking about was their hard work. I also want to thank Mr Sisa Makabela of the State Law Advisers who played an important oversight role in assisting the committee to tackle a number of issues in the Bill. I also want thank Mr Mark Heyink from civil society and Francis Cronj, as well as Alison Tilley from the Open Democracy Advice Centre. Lastly, I want to thank the committee secretary, Mr Vhonaani Rhomono, for the many hours he had to sit, and Miss Christine Silkstone, the content adviser, for the research performed and assistance she gave to the committee.
Hon Speaker, I think it only right that the technical committee, in turn, thanks the hon Jeffery for his chairing of that technical committee and for all the work that he has put into this important Bill.
I want to quote from a study of this Bill, undertaken by PricewaterhouseCoopers:
Open any newspaper or news website and the chances are that you will find a report on someone's right to personal privacy being infringed, or yet another intrusion through an organisation's security systems with the credit card or other financial information being stolen. With the free flow of information over the Internet, the popularity of social media, increasing ID book theft and other intrusions, governments worldwide have become increasingly concerned with the purposes for which organisations collect personal information, why they keep it and how they protect it. The position in South Africa is no different and consumers in South Africa should be welcoming the impending Protection of Personal Information Bill.
As you have heard, this Bill has been a long time in the making. At the conclusion of the writing of the Promotion of Access to Information Act in 2000, this House requested the Law Reform Commission to undertake work on privacy. Their work was long since done, but many other factors have delayed the completion of this Bill.
We were fortunate to have the advice of two people who travelled the entire road, from the Law Commission Report through to our tenth and final version of this Bill. They are Ms Ananda Louw, wearing red in the gallery - clearly it's a red-letter day! - and Mr Mark Heyink, from the private sector who assisted us. The Bill has greatly benefited from the enormous expertise and drafting skill of Mr Henk du Preez. We believe we have produced a law that will serve South Africans well. I quote PricewaterhouseCoopers again:
Although there are some disadvantages in lagging behind other countries in adopting privacy legislation, one major advantage is that the South African legislatures have been able to draw on the models developed and experience acquired in other countries, selecting the best of the best for our privacy legislation.
This Bill is the best of the best. The challenge for organisations, however, is that complying with the requirements of the Protection of Personal Information Bill is going to have a significant impact on the way they do business.
I am afraid that "a significant impact" is what is called for, on organisations both big and small. Our e-mail addresses, cellphone numbers, transactional history and financial details are constantly offered for sale. One seller of lists told his prospective buyers that they must remember that they owned data once they purchased it and could even resell it once they had used it. That is why we all constantly receive unsolicited calls and electronic messages which someone somewhere has matched to a profile that should only be created on the basis of information given with our knowledge and consent.
This Bill will be welcomed by everyone drowning in the daily tide of spam that washes into our inboxes. We have finally done what even the Internet service providers and e-commerce entities encouraged us to do in 2002, when we legislated the Electronic Communications and Transactions Act. We have moved away from the opt-out position, in terms of which you have to refuse a direct marketing offer or suffer the incoming spam. We have moved to an opt-in regime. Even the "techies" wanted us to do that as long ago as 2002. An opt-in regime means that unless you are already a customer of an enterprise, you specifically have to say yes before a direct marketer can send you its offers. That marketer can approach you only once and has to identify itself with contact details. We have seen one consumer case too many, covered by journalists like Independent Newspapers' Wendy Knowler, where unsuspecting consumers, often poor ones, suddenly find debit orders running off bank accounts whose details they never supplied for services or products they did not order, or which they were duped into signing up for. When they managed to track down the source, Knowler's readers were frequently told that the banking details had been obtained from the national consumer database, a thing that does not exist. Account details are stolen. We have therefore criminalised the obtaining, procurement, disclosure and sale of account numbers. The offence will carry a maximum sentence of 10 years or a commensurate fine.
We want all the benefits of computerisation to be realised in South Africa, including e-commerce. Trust is the ingredient that makes it work. That is why a company like Deloitte has spelled out the business benefits, including return on investment, that adherence to privacy rules present. Deloitte says: "PPI value for a brand is incalculable, just as its opposite incurs reputational and monetary loss." This was illustrated when R41 million was stolen from the Postbank by means of infiltrating an insecure database.
It is important to note that the Bill gives effect to the constitutional right to privacy while giving copious recognition to all other rights and social interests that compete with privacy, such as the free flow of information. It sets only minimum conditions for the processing of information. Each condition is qualified by exceptions, and over and above the exceptions, there are exclusions, and there is scope for exceptions. In other words, the Bill is replete with exceptions, exclusions and the like. It is more than reasonable.
The Information Regulator, which we create under the Bill, will help consumers by taking their complaints and, failing resolution, helping them to sue for damages. The regulator will also help organisations - and that includes government departments and businesses - to process private information properly, but if they don't, there are eventual sanctions, as the hon Jeffery has just set out.
The Information Regulator, a new, independent regulator that we are herewith creating - and this is a big breakthrough - will have functions and dedicated regulators under both the Protection of Personal Information Bill and the Promotion of Access to Information Act, Act 2 of 2000. We hope that the failure of access to information to date in South Africa, despite the Promotion of Access to Information Act, may now be cured. This regulator will be able to assess Promotion of Access to Information Act practices, take complaints for conciliation and also for action. Appeals against refusals for information under Promotion of Access to Information Act will be able to be taken to the regulator. This, finally, is the breakthrough that we suggested in the Chapter 9 review, and it is an enormous advance. Let me point out just one last endorsement: The hon Minister Trevor Manuel, who was here earlier, gave this Bill the "good housekeeping seal of approval". His National Development Plan, which has just been endorsed by Cabinet, states:
The Protection of Personal Information Bill that is being discussed in Parliament seeks to establish an information regulator covering certain aspects of information and personal data. This body should be equipped with the necessary resources to do its job properly and independently. The body should strike the right balance between its responsibilities to protect personal data, while providing recourse to those claiming their right of access to information.
It does, and we are delighted to support it. [Applause.]
Hon Speaker and Members of Parliament, I am sure we have all been in situations where we would receive a phone call from a very persistent salesperson wanting to sell certain products to us. The question we always ask afterwards is: Where did this person get my name and number?
With the passing of this Bill, such phone calls will soon be a thing of the past, provided, of course, that the conditions set out in this Bill are adhered to. South Africans will not have to ignore private calls anymore for fear that the call might be from some insurance company wanting to sell its policies. This Bill aims to ensure that we can receive such phone calls, e-mails or SMSs only if we are customers of a certain organisation and have consented to the processing of our personal information.
This Bill provides a regime of consumer protection in this day and age when the Internet is borderless and computers have systems in place to store vast volumes of electronic data. In simple terms, this Bill becomes the measuring stick that will ensure that the processing and/or outsourcing of our names, addresses, e-mail addresses, ID numbers, employment history and health data to third parties are in compliance with international standards.
Many years ago our parents used to hide money under the mattress in an attempt to save it from unknown systems and people in banks that might be instrumental in the disappearance of this money. This Bill must be seen as the "mattress" that will protect South Africans from unknown systems and people that want to disclose our personal information to strangers. Cope supports this Bill. [Applause.]
Mr Speaker, I too want to add my voice in thanking the hon John Jeffery for his kind and competent chairmanship of the subcommittee. This Bill is indeed a Bill of extreme complexity and we worked very hard on it. I do not wish to detract from anything that has been said by my colleagues. The Bill does bring about what has been indicated as its purpose. The finality and objective set out by my colleagues have been reached. What my concern has been throughout the entire process is what lies in the details. They say that the devil is in the details and this Bill has a great amount of detail behind which any devil can hide. Mine is not to decide; mine is only to influence the decision-making of others. I tried to work as hard as I could in the committee to influence the decision-making by my colleagues and intentionally withdrew from the last part of the deliberation process, which did see the acceptance of some of the suggestions made by me and my party. I am extremely thankful to the ANC and the other colleagues for that.
However, I remain concerned by the scope of application of this Bill. The nature of this Bill is that it applies to everyone in this House, in all its complexities and all its obligations. That will automatically make the conduct of the overwhelming majority of South African citizens non- compliant with the law, and wrongful. It will then be up to the regulator to decide in respect of whom to enforce the law. There will be a notice of compliance, after which there will be a criminal sanction.
This type of selective enforcement against a general type of application is a matter that has been sought to redress by proposing amendments that would make the Act applicable only where a code was adopted. So, there will be segmented implementation that will follow the pain - wherever there is pain in society - with an adequate remedy, rather than placing a remedy ahead of pain. However, this is an issue that will perhaps be carried over to further stages of discussion and deliberation and it needs overwhelming features characteristic of purpose. This is a Bill that we cannot but support. [Time expired.]
Hon Speaker, hon Deputy President, hon members and guests in the gallery, we are gathered here today in this law-making Chamber to give expression to a deeply entrenched right in accordance with section 14 of our Constitution - the right to privacy - in the shape of the Protection of Personal Information Bill. What is good about the discussion of this Bill is the overwhelming support it enjoys from all political parties.
Broadly speaking, the Bill's purpose is twofold: to protect personal information against unlawful collection, retention, dissemination and use; and to facilitate the free flow of information or data within South Africa and between countries.
The Bill incorporates internationally accepted principles. Specifically, its aims, as set out in clause 2, are to provide data subjects with remedies to enforce their right to have their information processed lawfully, which includes, among others, the right to be notified that their personal information is being processed or that an unauthorised person has accessed or acquired their personal information; to request access to personal information from a responsible party; not to have one's personal information processed for the purpose of direct marketing by means of unsolicited electronic communication; to complain to the information regulator regarding interference; and to institute civil proceedings relating to alleged interference.
The Bill in itself is comprehensive and not sector specific. It applies to both the public and private sectors. It applies to the processing of personal information belonging to all persons, whether natural or juristic.
In addition, the Bill transfers from the SA Human Rights Commission to the information regulator powers and functions related to the Promotion of Access to Information Act, Act 2 of 2000. For some time now, the need for a dedicated information commissioner to champion the challenge of access to information issues has been mooted.
Clause 43 of the Bill expressly provides for a full-time member of the regulator dedicated to exercising his or her powers and performing his or her functions and duties in terms of the Promotion of Access to Information Act. Once the internal appeals process provided by the Promotion of Access to Information Act has been exhausted, an aggrieved person can elect to approach for relief either a court or the regulator, who is empowered to deliver an enforcement notice.
Clause 5 of the Bill gives effect to data subjects' right to have responsible parties process their personal information in accordance with the conditions for lawful processing. This includes the right to be notified that their personal information is being processed.
The processing of personal information is excluded if personal information relates purely to personal or household activities; is anonymous and cannot be re-identified; is being processed by Cabinet and its committees or the executive council of a province; is processed by a public body; involves national security; or where the purpose of processing is the prevention, detection, investigation or proof of offences, the prosecution of offenders, the execution of sentences or security measures.
Other exclusions relate to the judicial functions of courts and for purposes of artistic and literary expression. The Bill does not apply to the processing of personal information for exclusively journalistic purposes, provided that the relevant responsible parties are, by virtue of their office, subject to a code of ethics that provides adequate safeguards for the protection of personal information.
The regulator can also exempt compliance with the conditions for lawful processing if it is in the public interest or if processing clearly benefits the data subject, the person affected or others, outweighing the interference in terms of clause 36.
In addition, the processing of children's personal information is totally prohibited, specifically children under 18 years of age who are not able to act without assistance.
As already mentioned, the Bill establishes an information regulator as an independent statutory body accountable to the National Assembly. The structure of the regulator will comprise a chairperson, with two full-time and two full-time or part-time persons.
The regulator has wide-ranging duties that include the promotion of its mandate; public education; advice; assistance; monitoring of compliance; examining the effects of proposed legislation; investigation of complaints; issuing enforcement notices; issuing and making guidelines to assist bodies to develop codes of conduct; and reviewing an adjudicator's decision under a code.
If the regulator has issued a code of conduct, failure to comply amounts to breach of a condition for lawful processing. The regulator can either issue a code on its own initiative after consultation with affected stakeholders or, if sufficiently representative, on application by a sufficiently representative body.
In conclusion, our Constitution provides for the right to privacy, as well as the right to access to information. These two rights are balanced and, therefore, where it is reasonable and justifiable to do so in an open democratic society, the right to privacy can be limited. The Bill provides for protection, as well as limitations of the right to privacy in relation to personal information.
This is Parliament of the people, for the people, in motion to promote and protect the rights of the people of South Africa. The ANC supports the Bill. [Applause.]
Mr Speaker, as other speakers have said, this Bill must be distinguished from the so-called "secrecy Bill", and maybe we should call this one the "privacy Bill". How often are we as members phoned about new cellphone contracts or other arbitrary offers? Did you give permission for that personal information to be used? In most cases the answer is no.
This Bill creates the legislative framework to protect personal information, but does so in a manner that still allows for the free flow of information, both within South Africa and between countries. It's all about balancing the right to privacy with the right to information. Consumers will and should welcome this Bill.
A specific exclusion for journalistic, literary and artistic purposes results in the necessary balance also being struck between the right to privacy and the right to freedom of expression, and this the ACDP also supports.
Our report also indicates that this is a field in which rapid technological advancement brings new challenges for the protection of personal data, and in this regard there are proposed changes to the European Union's legislation. Much of this is still being finalised, but the committee took these developments into account as far as is practically possible.
We as committee members are also very aware of the difficulties of enforcement mechanisms in the Promotion of Access to Information Act, including those related to the high incidence of deemed refusals. Today we again heard from the SA Human Rights Commission about the problems in this regard. At present, litigation seems to be the only recourse and this in itself is a lengthy and very expensive process. The Bill transfers these responsibilities to the Information Regulator. We as the ACDP trust that access to information - particularly that held by the state - will be made easier. The Promotion of Access to Information Act should and must enjoy priority and must trump other legislation, including the Protection of State Information Bill.
Lastly, the ACDP wishes to particularly thank the hon Jeffery, Dene Smuts, Mario Oriani-Ambrosini, as well as the officials who did such sterling work in the subcommittee. Well done and thank you for doing all the hard work! The ACDP will support this Bill. [Applause.]
Mr Speaker, hon Deputy President, at the end of this debate, mine is a simple task and that is to reiterate the thanks and appreciation, if I may, to this House and the portfolio committee. Our thanks and appreciation go to Henk du Preez, as has already been stated, to Ananda Louw of the SA Law Reform Commission, Adv Sisa Makabela of the Office of the Chief State Law Adviser, and to Mr Mark Heyink and Mr Francis Cronj of the private sector, who provided us with their legal and technical expertise and knowledge. This played a valuable role in the processing and drafting of the Bill.
We take this opportunity to express our gratitude to all persons and organisations that made inputs during the consideration of this Bill, through both their written and oral submissions to the portfolio committee.
We express a special word of appreciation to the media and the SA National Editors' Forum. They played an important role in our consideration of this Bill. All of these parties helped us to achieve that critical balance between the freedom of expression, the right of access to information and the individual's right to privacy.
As chairperson of the Portfolio Committee on Justice and Constitutional Development, I take this opportunity to express my thanks and that of the committee to the subcommittee, or technical committee, that drove this Bill. I refer to the hon John Jeffery of the ANC, the hon Dene Smuts of the DA and the hon Mario Oriani-Ambrosini of the IFP who did all the donkey work and, in doing so, helped to turn what would have been a difficult, arduous task into a relatively easy one for the committee.
I am privileged to chair a group of dedicated South Africans in the portfolio committee. They have presented this law to you and I believe this law will serve South Africa's people well. We recommend it to this House. [Applause.]
Mr Speaker, there being no opposition to this Bill, I recommend that the House adopts it.
Debate concluded.
Bill read a second time.