The Information Regulator recently published three guidance notes on:
- Exemptions from the conditions for lawful processing of personal information
- Processing of personal information of children
- Processing of special personal information
Guidance Note on Exemptions from the Conditions for Lawful Processing of Personal Information
The Protection of Personal Information Act (POPIA) prescribes eight conditions for the lawful processing of personal information. However, these conditions are not applicable where such processing has been exempted. The purpose of this Guidance Note is to guide responsible parties who intend to apply for exemption in terms of section 37 of POPIA; or who are exempt from the processing of personal information in respect of certain functions in terms of section 38 of POPIA.
The Information Regulator may grant an exemption to a responsible party to process certain personal information, even if that processing is in breach of a condition for the lawful processing of such information. In order for the Information Regulator to grant such an exemption, it must be satisfied that the requirements for an exemption are met which relate to either public interest or a clear benefit to the data subject.
1. Processing is in the public interest
In such an application, the responsible party must satisfy the Information Regulator that:
- the processing of personal information in question is in the public interest; and
- the public interest is so significant that it outweighs the data subject’s right to the protection of his or her personal information.
Or
2. Processing involves a clear benefit to the data subject
In such an application, the responsible party should prove that:
- the processing involves a clear benefit to the data subject or a third party; and
- this clear benefit outweighs, to a substantial degree, any interference with the privacy of the data subject or third party that could result from such processing.
Responsible parties may complete their applications for exemption from a condition for lawful processing of personal information using the application form and submit to the Information Regulator on POPIACompliance@inforegulator.org.za
Read Guidance Note on Exemptions from the Conditions for Lawful Processing of Personal Information
Guidance Note on Processing Personal Information of Children
Responsible parties are prohibited from processing the personal information of children. However, the Information Regulator may authorise a responsible party to process personal information of children where it is satisfied that such processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the child.
The purpose of this Guidance Note is to guide responsible parties who are required to obtain authorisation from the Information Regulator to process personal information of children as provided for in section 35(2) of POPIA.
The prohibition on processing of personal information of children does not apply if such processing is:
- carried out with the prior consent of a competent person (as defined);
- necessary for the establishment, exercise or defence of a right or obligation in law;
- necessary to comply with an obligation of international public law;
- for historical, statistical or research purposes subject to certain conditions.
The Guidance Note provides the manner in which a submission must be made for an application for authorisation, including the contact details and application form which must be used. Applications can be submitted to POPIACompliance@inforegulator.org.za Where a Responsible Party still requires assistance in completing the application form after reading the Guidance Note, it may contact the Information Regulator’s Customer Service Centre using the same email address.
Read the Guidance Note on Processing Personal Information of Children
Guidance Note on Processing of Special Personal Information
Section 26 of POPIA prohibits the processing of special personal information, subject to certain exceptions which are provided for in section 27(1). However, the Information Regulator may authorise a responsible party to process special personal information if the Regulator is satisfied that such processing is in the public interest and appropriate safeguards have been put in place to protect the special personal information of the data subject.
The purpose of this Guidance Note is to guide responsible parties who are required to obtain authorisation from the Information Regulator to process special personal information, as provided for in section 27(2) of POPIA.
A responsible party may not process any of the following special personal information of a data subject: religious beliefs, philosophical beliefs, race, ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or the criminal behaviour of a data subject (to the extent that such information relates to the alleged commission by a data subject of any offence; or any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings).
The prohibition on processing this personal information does not apply if such processing is:
- carried out with the consent of a data subject;
- necessary for the establishment, exercise or defence of a right or obligation in law;
- necessary to comply with an obligation of international public law;
- for historical, statistical or research purposes subject to certain conditions.
Applications for authorisation to process special personal information must be completed using the application form and submitted to the Information Regulator on POPIACompliance@inforegulator.org.za. The same email address may also be used where a Responsible Party still requires assistance in completing the application form after reading the Guidance Note.
Read Guidance Note on Processing of Special Personal Information
The Information Regulator has further reminded the industry that these Guidance Notes provide guidance only. Responsible parties are required to ensure compliance with the relevant provisions of POPIA. Any examples provided in the Guidance Notes are not exhaustive and should be regarded as mere guidance to improve understanding.