Category: POPIA

Section 70 Directories

  1. A data subject who is a subscriber to a printed or electronic directory of subscribers available to the public or obtainable through directory enquiry services, in which his, her or its personal information is included, must be informed, free of charge and before the information is included in the directory—
    1. about the purpose of the directory; and
    2. about any further uses to which the directory may possibly be put, based on search functions embedded in electronic versions of the directory.
  2. A data subject must be given a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of his, her or its personal information or to request verification, confirmation or withdrawal of such information if the data subject has not initially refused such use.
  3. Subsections (1) and (2) do not apply to editions of directories that were produced in printed or off-line electronic form prior to the commencement of this section.
  4. If the personal information of data subjects who are subscribers to fixed or mobile public voice telephony services have been included in a public subscriber directory in conformity with the conditions for the lawful processing of personal information prior to the commencement of this section, the personal information of such subscribers may remain included in this public directory in its printed or electronic versions, after having received the information required by subsection (1).
  5. ‘‘Subscriber’’, for purposes of this section, means any person who is party to a contract with the provider of publicly available electronic communications services for the supply of such services.

Section 71 Automated decision making

  1. Subject to subsection (2), a data subject may not be subject to a decision which results in legal consequences for him, her or it, or which affects him, her or it to a substantial degree, which is based solely on the basis of the automated processing of personal information intended to provide a profile of such person including his or her performance at work, or his, her or its credit worthiness, reliability, location, health, personal preferences or conduct.
  2. The provisions of subsection (1) do not apply if the decision—
    1. has been taken in connection with the conclusion or execution of a contract, and—
      1. the request of the data subject in terms of the contract has been met; or
      2. appropriate measures have been taken to protect the data subject’s legitimate interests; or
    2. is governed by a law or code of conduct in which appropriate measures are specified for protecting the legitimate interests of data subjects.
  3. The appropriate measures, referred to in subsection (2)(a)(ii), must—
    1. provide an opportunity for a data subject to make representations about a decision referred to in subsection (1); and
    2. require a responsible party to provide a data subject with sufficient information about the underlying logic of the automated processing of the information relating to him or her to enable him or her to make representations in terms of paragraph (a).

Section 72 Transfers of personal information outside Republic

  1. A responsible party in the Republic may not transfer personal information about a data subject to a third party who is in a foreign country unless—
    1. the third party who is the recipient of the information is subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection that—
      1. effectively upholds principles for reasonable processing of the information that are substantially similar to the conditions for the lawful processing of personal information relating to a data subject who is a natural person and, where applicable, a juristic person; and
      2. includes provisions, that are substantially similar to this section, relating to the further transfer of personal information from the recipient to third parties who are in a foreign country;
    2. the data subject consents to the transfer;
    3. the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request;
    4. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party; or
    5. the transfer is for the benefit of the data subject, and—
      1. it is not reasonably practicable to obtain the consent of the data subject to that transfer; and
      2. if it were reasonably practicable to obtain such consent, the data subject would be likely to give it.
  2. For the purpose of this section—
    1. ‘‘binding corporate rules’’ means personal information processing policies, within a group of undertakings, which are adhered to by a responsible party or operator within that group of undertakings when transferring personal information to a responsible party or operator within that same group of undertakings in a foreign country; and
    2. ‘‘group of undertakings’’ means a controlling undertaking and its controlled undertakings.

Section 73 Interference with protection of personal information of data subject

  1. For the purposes of this Chapter, interference with the protection of the personal information of a data subject consists, in relation to that data subject, of—
    1. any breach of the conditions for the lawful processing of personal information as referred to in Chapter 3;
    2. non-compliance with section 22, 54, 69, 70, 71 or 72; or
    3. a breach of the provisions of a code of conduct issued in terms of section 60.

Section 76 Action on receipt of complaint

  1. On receiving a complaint in terms of section 74, the Regulator may—
    1. conduct a pre-investigation as referred to in section 79;
    2. act, at any time during the investigation and where appropriate, as conciliator in relation to any interference with the protection of the personal information of a data subject in the prescribed manner;
    3. decide, in accordance with section 77, to take no action on the complaint or, as the case may be, require no further action in respect of the complaint;
    4. conduct a full investigation of the complaint;
    5. refer the complaint, in terms of section 92, to the Enforcement Committee; or
    6. take such further action as is contemplated by this Chapter.
  2. The Regulator must, as soon as is reasonably practicable, advise the complainant and the responsible party to whom the complaint relates of the course of action that the Regulator proposes to adopt under subsection (1).
  3. The Regulator may, on its own initiative, commence an investigation into the interference with the protection of the personal information of a data subject as referred to in section 73.

Section 77 Regulator may decide to take no action on complaint

  1. The Regulator, after investigating a complaint received in terms of section 73, may decide to take no action or, as the case may be, require no further action in respect of the complaint if, in the Regulator’s opinion—
    1. the length of time that has elapsed between the date when the subject matter of the complaint arose and the date when the complaint was made is such that an investigation of the complaint is no longer practicable or desirable;
    2. the subject matter of the complaint is trivial;
    3. the complaint is frivolous or vexatious or is not made in good faith;
    4. the complainant does not desire that action be taken or, as the case may be, continued;
    5. the complainant does not have a sufficient personal interest in the subject matter of the complaint; or
    6. in cases where the complaint relates to a matter in respect of which a code of conduct is in force and the code of conduct makes provision for a complaints procedure, the complainant has failed to pursue, or to pursue fully, an avenue of redress available under that complaints procedure that it would be reasonable for the complainant to pursue.
  2. Notwithstanding anything in subsection (1), the Regulator may in its discretion decide not to take any further action on a complaint if, in the course of the investigation of the complaint, it appears to the Regulator that, having regard to all the circumstances of the case, any further action is unnecessary or inappropriate.
  3. In any case where the Regulator decides to take no action, or no further action, on a complaint, the Regulator must inform the complainant of that decision and the reasons for it.

Section 78 Referral of complaint to regulatory body

  1. If, on receiving a complaint in terms of section 74, the Regulator considers that the complaint relates, in whole or in part, to a matter that is more properly within the jurisdiction of another regulatory body established in terms of any law, the Regulator must forthwith determine whether the complaint should be dealt with, in whole or in part, under this Act after consultation with the body concerned.
  2. If the Regulator determines that the complaint should be dealt with by another body, the Regulator must forthwith refer the complaint to that body to be dealt with accordingly and must notify the complainant of the referral.

Section 79 Pre-investigation proceedings of Regulator

  1. Before proceeding to investigate any matter in terms of this Chapter, the Regulator must, in the prescribed manner, inform—
    1. the complainant, the data subject to whom the investigation relates (if not the complainant) and any person alleged to be aggrieved (if not the complainant), of the Regulator’s intention to conduct the investigation; and
    2. the responsible party to whom the investigation relates of the—
      1. details of the complaint or, as the case may be, the subject matter of the investigation; and
      2. right of that responsible party to submit to the Regulator, within a reasonable period, a written response in relation to the complaint or, as the case may be, the subject-matter of the investigation.