Author: Accessible Law

Section 90 Information notice

  1. If the Regulator—
    1. has received a request under section 89 in respect of any processing of personal information; or
    2. reasonably requires any information for the purpose of determining whether the responsible party has interfered or is interfering with the personal information of a data subject,
    3. the Regulator may serve the responsible party with an information notice requiring the responsible party to furnish the Regulator, within a specified period, in a form specified in the notice, with a report indicating that the processing is taking place in compliance with the provisions of the Act, or with such information relating to the request or to compliance with the Act as is so specified.
  2. An information notice must contain particulars of the right of appeal conferred by section 97, and—
    1. in a case falling within subsection (1)(a), a statement that the Regulator has received a request under section 89 in relation to the specified processing; or
    2. in a case falling within subsection (1)(b), a statement that the Regulator regards the specified information as relevant for the purpose of determining whether the responsible party has complied, or is complying, with the conditions for the lawful processing of personal information and the reasons for regarding it as relevant for that purpose.
  3. Subject to subsection (5), the period specified in an information notice must not expire before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the information need not be furnished pending the determination or withdrawal of the appeal.
  4. If the Regulator considers that the information is required as a matter of urgency, it may include in the notice a statement to that effect and a statement of its reasons for reaching that conclusion, and in that event subsection (3) does not apply.
  5. A notice in terms of subsection (4) may not require the information to be furnished before the end of a period of three days beginning with the day on which the notice is served.
  6. An information notice may not require a responsible party to furnish the Regulator with any communication between a—
    1. professional legal adviser and his or her client in connection with the giving of legal advice on the client’s obligations, liabilities or rights under this Act; or
    2. professional legal adviser and his or her client, or between such an adviser or his or her client and any other person, made in connection with or in contemplation of proceedings under or arising out of this Act (including proceedings before a court) and for the purposes of such proceedings.
  7. In subsection (6) references to the client of a professional legal adviser include any person representing such a client.
  8. An information notice may not require a responsible party to furnish the Regulator with information that would, by revealing evidence of the commission of any offence other than an offence under this Act, expose the responsible party to criminal proceedings.
  9. The Regulator may cancel an information notice by written notice to the responsible party on whom it was served.

Section 91 Parties to be informed of result of assessment

  1. After completing the assessment referred to in section 89 the Regulator—
    1. must report to the responsible party the results of the assessment and any recommendations that the Regulator considers appropriate; and
    2. may, in appropriate cases, require the responsible party, within a specified time, to inform the Regulator of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken.
  2. The Regulator may make public any information relating to the personal information management practices of a responsible party that has been the subject of an assessment under this section if the Regulator considers it in the public interest to do so.
  3. A report made by the Regulator under subsection (1) is deemed to be the equivalent of an enforcement notice in terms of section 95.

Section 92 Matters referred to Enforcement Committee

  1. After completing the investigation of a complaint or other matter in terms of this Act, the Regulator may refer such complaint or other matter to the Enforcement Committee for consideration, a finding in respect of the complaint or other matter and a recommendation in respect of the proposed action to be taken by the Regulator as referred to in section 93.
  2. The Regulator may prescribe the procedure to be followed by the Enforcement Committee, including—
    1. the manner in which the responsible party and data subject may make submissions to the Enforcement Committee;
    2. the opportunity afforded to the parties who make submissions to the Enforcement Committee to make use of legal or other representation;
    3. the period within which the Enforcement Committee must make a finding and submit its recommendation to the Regulator in respect of the complaint or other matter; and
    4. the manner in which the Enforcement Committee may finalise urgent matters.

Section 93 Functions of Enforcement Committee

  1. The Enforcement Committee—
    1. must consider all matters referred to it by the Regulator in terms of section 92 or the Promotion of Access to Information Act and make a finding in respect thereof; and
    2. may make any recommendation to the Regulator necessary or incidental to any action that should be taken against—
      1. a responsible party in terms of this Act; or
      2. an information officer or head of a private body, as the case may be, in terms of the Promotion of Access to Information Act.

Section 94 Parties to be informed of developments during and result of investigation

  1. If an investigation is made following a complaint, and—
    1. the Regulator believes that no interference with the protection of the personal information of a data subject has taken place and therefore does not serve an enforcement notice;
    2. the Regulator has referred the complaint to the Enforcement Committee for consideration in terms of section 92;
    3. an enforcement notice is served in terms of section 95;
    4. a served enforcement notice is cancelled in terms of section 96;
    5. an appeal is lodged against the enforcement notice for cancellation or variation of the notice in terms of section 97; or
    6. an appeal against an enforcement notice is allowed, the notice is substituted or the appeal is dismissed in terms of section 98,
    7. the Regulator must inform the complainant and the responsible party, as soon as reasonably practicable, in the manner prescribed of any development mentioned in paragraphs (a) to (f) and the result of the investigation.

Section 95 Enforcement notice

  1. If the Regulator, after having considered the recommendation of the Enforcement Committee in terms of section 93, is satisfied that a responsible party has interfered or is interfering with the protection of the personal information of a data subject as referred to in section 73, the Regulator may serve the responsible party with an enforcement notice requiring the responsible party to do either or both of the following:
    1. to take specified steps within a period specified in the notice, or to refrain from taking such steps; or
    2. to stop processing personal information specified in the notice, or to stop processing personal information for a purpose or in a manner specified in the notice within a period specified in the notice.
  2. An enforcement notice must contain—
    1. a statement indicating the nature of the interference with the protection of the personal information of the data subject and the reasons for reaching that conclusion; and
    2. particulars of the rights of appeal conferred by section 97.
  3. Subject to subsection (4), an enforcement notice may not require any of the provisions of the notice to be complied with before the end of the period within which an appeal may be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.
  4. If the Regulator considers that an enforcement notice should be complied with as a matter of urgency it may include in the notice a statement to that effect and a statement of its reasons for reaching that conclusion, and in that event subsection (3) does not apply.
  5. A notice in terms of subsection (4) may not require any of the provisions of the notice to be complied with before the end of a period of three days beginning with the day on which the notice is served.

Section 96 Cancellation of enforcement notice

  1. A responsible party on whom an enforcement notice has been served may, at any time after the expiry of the period during which an appeal may be brought against that notice, apply in writing to the Regulator for the cancellation or variation of that notice on the ground that, by reason of a change of circumstances, all or any of the provisions of that notice need not be complied with in order to ensure compliance with the conditions for the lawful processing of personal information.
  2. If the Regulator considers that all or any of the provisions of an enforcement notice need not be complied with in order to ensure compliance with a condition for the lawful processing of personal information or conditions to which it relates, it may cancel or vary the notice by written notice to the responsible party on whom it was served.

Section 97 Right of appeal

  1. A responsible party on whom an information or enforcement notice has been served may, within 30 days of receiving the notice, appeal to the High Court having jurisdiction for the setting aside or variation of the notice.
  2. A complainant, who has been informed of the result of the investigation in terms of section 77(3) or 96, may, within 180 days of receiving the result, appeal to the High Court having jurisdiction against the result.

Section 98 Consideration of appeal

  1. If in an appeal under section 97 the court considers—
    1. that the notice or decision against which the appeal is brought is not in accordance with the law; or
    2. that the notice or decision involved an exercise of discretion by the Regulator that ought to have been exercised differently,
    3. the court must allow the appeal and may set aside the notice or substitute such other notice or decision as should have been served or made by the Regulator.
  2. In such an appeal, the court may review any determination of fact on which the notice in question was based.

Section 99 Civil remedies

  1. A data subject or, at the request of the data subject, the Regulator, may institute a civil action for damages in a court having jurisdiction against a responsible party for breach of any provision of this Act as referred to in section 73, whether or not there is intent or negligence on the part of the responsible party.
  2. In the event of a breach the responsible party may raise any of the following defences against an action for damages:
    1. vis major;
    2. consent of the plaintiff;
    3. fault on the part of the plaintiff;
    4. compliance was not reasonably practicable in the circumstances of the particular case; or
    5. the Regulator has granted an exemption in terms of section 37.
  3. A court hearing proceedings in terms of subsection (1) may award an amount that is just and equitable, including—
    1. payment of damages as compensation for patrimonial and non-patrimonial loss suffered by a data subject as a result of breach of the provisions of this Act;
    2. aggravated damages, in a sum determined in the discretion of the Court;
    3. interest; and
    4. costs of suit on such scale as may be determined by the Court.
  4. Any amount awarded to the Regulator in terms of subsection (3) must be dealt with in the following manner:
    1. the full amount must be deposited into a specifically designated trust account established by the Regulator with an appropriate financial institution;
    2. as a first charge against the amount, the Regulator may recover all reasonable expenses incurred in bringing proceedings at the request of a data subject in terms of subsection (1) and in administering the distributions made to the data subject in terms of subsection (5); and
    3. the balance, if any (in this section referred to as the ‘‘distributable balance’’), must be distributed by the Regulator to the data subject at whose request the proceedings were brought.
  5. Any amount not distributed within three years from the date of the first distribution of payments in terms of subsection (4), accrue to the Regulator in the Regulator’s official capacity.
  6. The distributable balance must be distributed on a pro rata basis to the data subject referred to in subsection (1).
  7. A Court issuing any order under this section must order it to be published in the Gazette and by such other appropriate public media announcement as the Court considers appropriate.
  8. Any civil action instituted under this section may be withdrawn, abandoned or compromised, but any agreement or compromise must be made an order of Court.
  9. If a civil action has not been instituted, any agreement or settlement, if any, may, on application to the Court by the Regulator after due notice to the other party, be made an order of Court and must be published in the Gazette and by such other public media announcement as the Court considers appropriate.