A very interesting article on the Werksmans website provides some insight into what may just be the first of many unforeseen outcomes of this new legislation.
A Legalbrief Today article points out that, in the focus of the Act on juristic entities, it may have lost sight of how it would impact on natural persons.
While a great deal of attention has been given to juristic entities’ compliance with Protection of Personal Information Act (Popia) which will come into effect on 1 July, a ‘lesser’ explored subject is the implications of Popia on natural persons – taking into account the processing of personal information on social media platforms.
Writing on the Moneyweb site, Werksmans Attorneys’ Zamathiyane Mthiyane looks at the case where an individual discovers a ‘post’ disclosing certain of his/ her ‘personal information’, including a photograph, on a social media platform.
She says on a prima facia reading of Popia, the subject of the post may be considered a ‘data subject’ and the person who posted the photograph may be considered a ‘responsible party’. Posting the personal information on social media would, she says, amount to the dissemination of personal information, as contemplated in the definition of ‘processing’ in Popia. Thus, the responsible party may be obliged to comply with the provisions of Popia, which include the requirement to comply with the eight conditions of lawful processing of personal information. These include a requirement to obtain the consent of the data subject prior to posting a photograph or the views of that data subject on a social media platform.
The responsible party would also be required to appoint an information officer and publish and comply with a Popia manual as read with section 51 of the Promotion of Access to Information Act.
Mthiyane says this would lead to an ‘absurd’ result: every individual who posts photos, memes, videos or the views of another person, is considered a responsible party who must comply with onerous conditions. To prevent this, section 6(1)(a) of the Act states that it does not apply to the processing of personal information in the course of a purely personal or household activity.
This means that Popia applies only to business or professional activities; and ‘in so far as any pictures or video taken or views shared are disseminated on social media or any other platform in a personal capacity, Popia arguably does not apply’.
Mthiyane adds that as Popia does not define the terms ‘personal activity’ or ‘household activity’ – these will have to be interpreted on a case-by-case basis. However, she says disgruntled individuals who find their personal information posted on social media platforms without their consent are not without legal remedy. Our common law, as codified in the Constitution, protects individual’s right to privacy on a professional and personal basis.
‘Thus, social media users who post what may be considered as personal information, should do so, keeping in mind that the subject of the posts – although falling out of the ambit of Popia – are still protected by the common law in the event that the post breaches the privacy of the subject.’
