Category: POPIA

Section 49 Committees of Regulator

  1. The Regulator may, if it considers it necessary for the proper performance of its functions establish one or more committees, which must consist of—
    1. such members of the Regulator as the Regulator may designate; or
    2. such members of the Regulator as the Regulator may designate and other persons appointed by the Regulator, as referred to in section 47(7), for the period determined by the Regulator.
  2. The Regulator may at any time extend the period of an appointment referred to in subsection (1)(b) or, if in its opinion good reasons exist therefor, revoke any such appointment.
  3. The Regulator must designate the chairperson and, if the Regulator deems it necessary, the vice-chairperson of a committee established under subsection (1).
    1. A committee referred to in subsection (1) must, subject to the directions of the Regulator, perform those functions of the Regulator assigned to it by the Regulator.
    2. Any function so performed by a committee referred to in subsection (1) will be deemed to have been performed by the Regulator.
  5. The Regulator may at any time dissolve any committee established by the Regulator.
  6. The provisions of sections 40(4) and 51 will apply, with the necessary changes, to a committee of the Regulator.

Section 50 Establishment of Enforcement Committee

  1. The Regulator must establish an Enforcement Committee which must consist of—
    1. at least one member of the Regulator; and
    2. such other persons appointed by the Regulator, as referred to in section 47(7), for the period determined by the Regulator.
  2. The Regulator must—
    1. in consultation with the Chief Justice and Minister, appoint a—
      1. judge of the High Court of South Africa, whether in active service or not; or
      2. magistrate with at least 10 years’ appropriate experience, whether in active service or not; or
    2. appoint an advocate or attorney with at least 10 years’ appropriate experience, as Chairperson of the Enforcement Committee.
  3. The Chairperson of the Enforcement Committee must manage the work of and preside at hearings of the Enforcement Committee.
    1. A member referred to in subsection (1)(a) may not participate in any proceedings of the Regulator in terms of which a decision is taken with regard to a recommendation by the Enforcement Committee as referred to in section 93.
    2. A person referred to in subsection (1)(b) must be a fit and proper person and must comply with the criteria, referred to in section 41(1)(g), for appointment as a member of the Regulator.

Section 51 Meetings of Regulator

  1. Meetings of the Regulator must be held at the times and places determined by the Chairperson of the Regulator.
  2. Three members of the Regulator constitute a quorum for a meeting.
    1. The Chairperson may regulate the proceedings at meetings as he or she may think fit and must keep minutes of the proceedings.
    2. If the Chairperson is absent from a meeting the members present shall elect one of their number to preside at that meeting.
    1. Subject to subsection (2), a decision of the Regulator is taken by resolution agreed to by the majority of members at any meeting of the Regulator.
    2. In the event of an equality of votes regarding any matter the Chairperson has a casting vote in addition to his or her deliberative vote.

Section 52 Funds

  1. Funds of the Regulator consist of—
    1. such sums of money that Parliament appropriates annually, for the use of the Regulator as may be necessary for the proper exercise, performance and discharge, by the Regulator, of its powers, duties and functions under this Act and the Promotion of Access to Information Act; and
    2. fees as may be prescribed in terms of section 111(1).
  2. The financial year of the Regulator is the period from 1 April in any year to 31 March in the following year, except that the first financial year of the Regulator begins on the date that this Chapter comes into operation, and ends on 31 March next following that date.
  3. The chief executive officer of the Regulator is for purposes of the Public Finance Management Act, 1999 (Act No. 1 of 1999), the accounting officer and must execute his or her duties in accordance with that Act.
  4. Within six months after the end of each financial year, the Regulator must prepare financial statements in accordance with established accounting practice, principles and procedures, comprising—
    1. a statement reflecting, with suitable and sufficient particulars, the income and expenditure of the Regulator during the preceding financial year; and
    2. a balance sheet showing the state of its assets, liabilities and financial position as at the end of that financial year.
  5. The Auditor-General must audit the Regulator’s financial records each year.

Section 53 Protection of Regulator

Any person acting on behalf or under the direction of the Regulator, is not civilly or criminally liable for anything done in good faith in the exercise or performance or purported exercise or performance of any power, duty or function of the Regulator in terms of this Act or the Promotion of Access to Information Act.

Section 54 Duty of confidentiality

A person acting on behalf or under the direction of the Regulator, must, both during or after his or her term of office or employment, treat as confidential the personal information which comes to his or her knowledge in the course of the performance of his or her official duties, except if the communication of such information is required by law or in the proper performance of his or her duties.

Section 55 Duties and responsibilities of Information Officer

  1. An information officer’s responsibilities include—
    1. the encouragement of compliance, by the body, with the conditions for the lawful processing of personal information;
    2. dealing with requests made to the body pursuant to this Act;
    3. working with the Regulator in relation to investigations conducted pursuant to Chapter 6 in relation to the body;
    4. otherwise ensuring compliance by the body with the provisions of this Act; and
    5. as may be prescribed.
  2. Officers must take up their duties in terms of this Act only after the responsible party has registered them with the Regulator.

Section 56 Designation and delegation of deputy information officers

Each public and private body must make provision, in the manner prescribed in section 17 of the Promotion of Access to Information Act, with the necessary changes, for the designation of—

  1. such a number of persons, if any, as deputy information officers as is necessary to perform the duties and responsibilities as set out in section 55(1) of this Act; and
  2. any power or duty conferred or imposed on an information officer by this Act to a deputy information officer of that public or private body.

Section 57 Processing subject to prior authorisation

  1. The responsible party must obtain prior authorisation from the Regulator, in terms of section 58, prior to any processing if that responsible party plans to—
    1. process any unique identifiers of data subjects —
      1. for a purpose other than the one for which the identifier was specifically intended at collection; and
      2. with the aim of linking the information together with information processed by other responsible parties;
    2. process information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties;
    3. process information for the purposes of credit reporting; or
    4. transfer special personal information, as referred to in section 26, or the personal information of children as referred to in section 34, to a third party in a foreign country that does not provide an adequate level of protection for the processing of personal information as referred to in section 72.
  2. The provisions of subsection (1) may be applied by the Regulator to other types of information processing by law or regulation if such processing carries a particular risk for the legitimate interests of the data subject.
  3. This section and section 58 are not applicable if a code of conduct has been issued and has come into force in terms of Chapter 7 in a specific sector or sectors of society.
  4. A responsible party must obtain prior authorisation as referred to in subsection (1) only once and not each time that personal information is received or processed, except where the processing departs from that which has been authorised in accordance with the provisions of subsection (1).

Section 58 Responsible party to notify Regulator if processing is subject to prior authorisation

  1. Information processing as contemplated in section 57(1) must be notified as such by the responsible party to the Regulator.
  2. Responsible parties may not carry out information processing that has been notified to the Regulator in terms of subsection (1) until the Regulator has completed its investigation or until they have received notice that a more detailed investigation will not be conducted.
  3. In the case of the notification of information processing to which section 57(1) is applicable, the Regulator must inform the responsible party in writing within four weeks of the notification as to whether or not it will conduct a more detailed investigation.
  4. In the event that the Regulator decides to conduct a more detailed investigation, it must indicate the period within which it plans to conduct this investigation, which period must not exceed 13 weeks.
  5. On conclusion of the more detailed investigation referred to in subsection (4) the Regulator must issue a statement concerning the lawfulness of the information processing.
  6. A statement by the Regulator in terms of subsection (5), to the extent that the information processing is not lawful, is deemed to be an enforcement notice served in terms of section 95 of this Act.
  7. A responsible party that has suspended its processing as required by subsection (2), and which has not received the Regulator’s decision within the time limits specified in subsections (3) and (4), may presume a decision in its favour and continue with its processing.