Hon Speaker, hon Deputy President, hon members and guests in the gallery, we are gathered here today in this law-making Chamber to give expression to a deeply entrenched right in accordance with section 14 of our Constitution - the right to privacy - in the shape of the Protection of Personal Information Bill. What is good about the discussion of this Bill is the overwhelming support it enjoys from all political parties.
Broadly speaking, the Bill's purpose is twofold: to protect personal information against unlawful collection, retention, dissemination and use; and to facilitate the free flow of information or data within South Africa and between countries.
The Bill incorporates internationally accepted principles. Specifically, its aims, as set out in clause 2, are to provide data subjects with remedies to enforce their right to have their information processed lawfully, which includes, among others, the right to be notified that their personal information is being processed or that an unauthorised person has accessed or acquired their personal information; to request access to personal information from a responsible party; not to have one's personal information processed for the purpose of direct marketing by means of unsolicited electronic communication; to complain to the information regulator regarding interference; and to institute civil proceedings relating to alleged interference.
The Bill in itself is comprehensive and not sector specific. It applies to both the public and private sectors. It applies to the processing of personal information belonging to all persons, whether natural or juristic.
In addition, the Bill transfers from the SA Human Rights Commission to the information regulator powers and functions related to the Promotion of Access to Information Act, Act 2 of 2000. For some time now, the need for a dedicated information commissioner to champion the challenge of access to information issues has been mooted.
Clause 43 of the Bill expressly provides for a full-time member of the regulator dedicated to exercising his or her powers and performing his or her functions and duties in terms of the Promotion of Access to Information Act. Once the internal appeals process provided by the Promotion of Access to Information Act has been exhausted, an aggrieved person can elect to approach for relief either a court or the regulator, who is empowered to deliver an enforcement notice.
Clause 5 of the Bill gives effect to data subjects' right to have responsible parties process their personal information in accordance with the conditions for lawful processing. This includes the right to be notified that their personal information is being processed.
The processing of personal information is excluded if personal information relates purely to personal or household activities; is anonymous and cannot be re-identified; is being processed by Cabinet and its committees or the executive council of a province; is processed by a public body; involves national security; or where the purpose of processing is the prevention, detection, investigation or proof of offences, the prosecution of offenders, the execution of sentences or security measures.
Other exclusions relate to the judicial functions of courts and for purposes of artistic and literary expression. The Bill does not apply to the processing of personal information for exclusively journalistic purposes, provided that the relevant responsible parties are, by virtue of their office, subject to a code of ethics that provides adequate safeguards for the protection of personal information.
The regulator can also exempt compliance with the conditions for lawful processing if it is in the public interest or if processing clearly benefits the data subject, the person affected or others, outweighing the interference in terms of clause 36.
In addition, the processing of children's personal information is totally prohibited, specifically children under 18 years of age who are not able to act without assistance.
As already mentioned, the Bill establishes an information regulator as an independent statutory body accountable to the National Assembly. The structure of the regulator will comprise a chairperson, with two full-time and two full-time or part-time persons.
The regulator has wide-ranging duties that include the promotion of its mandate; public education; advice; assistance; monitoring of compliance; examining the effects of proposed legislation; investigation of complaints; issuing enforcement notices; issuing and making guidelines to assist bodies to develop codes of conduct; and reviewing an adjudicator's decision under a code.
If the regulator has issued a code of conduct, failure to comply amounts to breach of a condition for lawful processing. The regulator can either issue a code on its own initiative after consultation with affected stakeholders or, if sufficiently representative, on application by a sufficiently representative body.
In conclusion, our Constitution provides for the right to privacy, as well as the right to access to information. These two rights are balanced and, therefore, where it is reasonable and justifiable to do so in an open democratic society, the right to privacy can be limited. The Bill provides for protection, as well as limitations of the right to privacy in relation to personal information.
This is Parliament of the people, for the people, in motion to promote and protect the rights of the people of South Africa. The ANC supports the Bill. [Applause.]