This POPI is not a flower

As can be expected, the establishment of the office of the Information Regulator is experiencing some start-up problems. With 1 July 2021 set as the date when the final sections of the Protection of Personal Information Act (POPIA) comes into effect, we learnt earlier this week that a number of reprieves have been published:

• The Information Regulator has confirmed that there will be no deadline for registration of Information officers (IO) and Deputy Information Officers (DIO). This means that no responsible party will be held liable for not registering by 30 June 2021. This decision follows technical glitches with the registration portal and numerous concerns raised by responsible parties regarding the registration process.
• The registration of a Chief Executive Officer (CEO) as an Information Officer for multiple legal entities has been taken into consideration and it will be permissible. The registration portal is currently being configured to accommodate these changes. When the registration portal has been updated, it will be announced.
• In addition, the Regulator has extended the applications for Prior Authorisation in terms section 57 (1) subject to section 58 (2) to 01 February 2022.
• The Information Regulator as of 30 June will also be taking over the function of the Promotion of Access to Information Act (PAIA) from the South African Human Rights Commission (SAHRC). Should the public require lodging a complaint, they may approach the Regulator to adjudicate, or they may approach the court directly.

Exemption from complying with certain conditions

The publication of a Guidance Note on Exemptions from the Conditions for Lawful Processing of Personal Information in terms of Section 37 and 38 of POPIA provides some insight into what the future holds.

The purpose of the Guidance Note is to assist responsible parties who-

• intend to apply for exemption in terms of section 37 of POPIA; or
• are exempt from the processing of personal information.

POPIA prescribes the eight conditions for the lawful processing of personal information by or for a responsible party. These conditions are not applicable to the processing of personal information to the extent that such processing is exempted in terms of section 37 or 38, from one or more of the conditions concerned in relation to such processing.

Processing of personal information is not in breach of a condition for the processing of such information if the Regulator grants an exemption in terms of section 37 or processing is in accordance with section 38.

A cursory glance at the four-page application form makes it abundantly clear that you would need considerable insight into the applicable legislation to complete it correctly.

What to do?

Whilst the natural reaction will be to sit back and relax, it might be wiser to use the extra time to get your ducks in a row for when the legislation kicks in. POPIA might take some time to settle down, but it won’t go away.

At Moonstone we are not underestimating the impact of this and have developed several interventions to assist the industry in coping with these additional demands.

• The Moonstone Business School of Excellence (MBSE) has designed three training interventions based on the various levels of knowledge required for effective implementation of the POPIA requirements.
• Moonstone Compliance and Risk Management has developed a DIY POPIA kit for small to medium enterprises containing everything, including the kitchen sink and templates, to comply with all the required processes and procedures. Our compliance clients can download this for free, while a once-off fee is charged for others who wish to download it.
• We have also established a POPIA advisory service for bigger institutions who require legal expertise from a subject matter specialist. More on this to follow soon.