On 15 October 2021, the Information Regulator published an invitation for public comments on the Amendment of the Regulations Relating to the Protection of Personal Information, 2018 (“Draft Regulations”). The Draft Regulations address steps which the public can take in exercising their rights under the Protection of Personal Information Act 4 of 2013 (“POPIA”) and how businesses can request consent for direct marketing purposes.
The Draft Regulations set out how data subjects can object to their personal information being processed. Businesses are required to inform data subjects about their right to object to the processing of their personal information. This may require some businesses to revisit their privacy policies to ensure these are POPIA compliant.
The Draft Regulations also provide that if a data subject requests a business to correct, destroy or delete their personal information, the organisation must notify the data subject of the action taken in compliance with the request, within fourteen calendar days.
An important factor which is covered in the new Draft Regulations is where businesses request a person’s consent to process their personal information for direct marketing through unsolicited electronic communication. The current POPIA regulations require that written consent be given in a prescribed form attached to the existing regulations. However, the Draft Regulations permit a business to obtain consent using a form substantially similar to Form 4 or “in any manner that may be expedient”. This interesting development shows the purpose to alleviate the administrative burden somewhat for businesses in ensuring compliance with this consent requirement.
If parties wish to file a complaint with the Information Regulator, the Draft Regulations provide a clear procedure on how affected parties may submit such complaints, with clarification on which parties may submit a complaint; the information which must be included in the complaint; where and how to submit a complaint; and how to submit an anonymous complaint.
Businesses which have already applied to the Information Regulator for the issuing of a code of conduct, using the prescribed form attached to the current POPIA regulations, would not need to submit a new application to the Information Regulator on the amended prescribed form attached to the Draft Regulations.
The public is invited to submit their comments to the Information Regulator by 15 November 2021. We are able to assist you in formulating and submitting such comments and guiding you in interpreting the Draft Regulations and their impact on your POPIA compliance.