Category: Risks of non-compliance

Section 5 Rights of data subjects

  1. A data subject has the right to have his, her or its personal information processed in accordance with the conditions for the lawful processing of personal information as referred to in Chapter 3, including the right—
    1. to be notified that—
      1. personal information about him, her or it is being collected as provided for in terms of section 18; or
      2. his, her or its personal information has been accessed or acquired by an unauthorised person as provided for in terms of section 22;
    2. to establish whether a responsible party holds personal information of that data subject and to request access to his, her or its personal information as provided for in terms of section 23;
    3. to request, where necessary, the correction, destruction or deletion of his, her or its personal information as provided for in terms of section 24;
    4. to object, on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its personal information as provided for in terms of section 11(3)(a);
    5. to object to the processing of his, her or its personal information—
      1. at any time for purposes of direct marketing in terms of section 11(3)(b); or
      2. in terms of section 69(3)(c);
    6. not to have his, her or its personal information processed for purposes of direct marketing by means of unsolicited electronic communications except as referred to in section 69(1);
    7. not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its personal information intended to provide a profile of such person as provided for in terms of section 71;
    8. to submit a complaint to the Regulator regarding the alleged interference with the protection of the personal information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74; and
    9. to institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99.

Section 73 Interference with protection of personal information of data subject

  1. For the purposes of this Chapter, interference with the protection of the personal information of a data subject consists, in relation to that data subject, of—
    1. any breach of the conditions for the lawful processing of personal information as referred to in Chapter 3;
    2. non-compliance with section 22, 54, 69, 70, 71 or 72; or
    3. a breach of the provisions of a code of conduct issued in terms of section 60.

Section 95 Enforcement notice

  1. If the Regulator, after having considered the recommendation of the Enforcement Committee in terms of section 93, is satisfied that a responsible party has interfered or is interfering with the protection of the personal information of a data subject as referred to in section 73, the Regulator may serve the responsible party with an enforcement notice requiring the responsible party to do either or both of the following:
    1. to take specified steps within a period specified in the notice, or to refrain from taking such steps; or
    2. to stop processing personal information specified in the notice, or to stop processing personal information for a purpose or in a manner specified in the notice within a period specified in the notice.
  2. An enforcement notice must contain—
    1. a statement indicating the nature of the interference with the protection of the personal information of the data subject and the reasons for reaching that conclusion; and
    2. particulars of the rights of appeal conferred by section 97.
  3. Subject to subsection (4), an enforcement notice may not require any of the provisions of the notice to be complied with before the end of the period within which an appeal may be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.
  4. If the Regulator considers that an enforcement notice should be complied with as a matter of urgency it may include in the notice a statement to that effect and a statement of its reasons for reaching that conclusion, and in that event subsection (3) does not apply.
  5. A notice in terms of subsection (4) may not require any of the provisions of the notice to be complied with before the end of a period of three days beginning with the day on which the notice is served.

Section 99 Civil remedies

  1. A data subject or, at the request of the data subject, the Regulator, may institute a civil action for damages in a court having jurisdiction against a responsible party for breach of any provision of this Act as referred to in section 73, whether or not there is intent or negligence on the part of the responsible party.
  2. In the event of a breach the responsible party may raise any of the following defences against an action for damages:
    1. vis major;
    2. consent of the plaintiff;
    3. fault on the part of the plaintiff;
    4. compliance was not reasonably practicable in the circumstances of the particular case; or
    5. the Regulator has granted an exemption in terms of section 37.
  3. A court hearing proceedings in terms of subsection (1) may award an amount that is just and equitable, including—
    1. payment of damages as compensation for patrimonial and non-patrimonial loss suffered by a data subject as a result of breach of the provisions of this Act;
    2. aggravated damages, in a sum determined in the discretion of the Court;
    3. interest; and
    4. costs of suit on such scale as may be determined by the Court.
  4. Any amount awarded to the Regulator in terms of subsection (3) must be dealt with in the following manner:
    1. the full amount must be deposited into a specifically designated trust account established by the Regulator with an appropriate financial institution;
    2. as a first charge against the amount, the Regulator may recover all reasonable expenses incurred in bringing proceedings at the request of a data subject in terms of subsection (1) and in administering the distributions made to the data subject in terms of subsection (5); and
    3. the balance, if any (in this section referred to as the ‘‘distributable balance’’), must be distributed by the Regulator to the data subject at whose request the proceedings were brought.
  5. Any amount not distributed within three years from the date of the first distribution of payments in terms of subsection (4), accrue to the Regulator in the Regulator’s official capacity.
  6. The distributable balance must be distributed on a pro rata basis to the data subject referred to in subsection (1).
  7. A Court issuing any order under this section must order it to be published in the Gazette and by such other appropriate public media announcement as the Court considers appropriate.
  8. Any civil action instituted under this section may be withdrawn, abandoned or compromised, but any agreement or compromise must be made an order of Court.
  9. If a civil action has not been instituted, any agreement or settlement, if any, may, on application to the Court by the Regulator after due notice to the other party, be made an order of Court and must be published in the Gazette and by such other public media announcement as the Court considers appropriate.

Section 105 Unlawful acts by responsible party in connection with account number

  1. A responsible party who contravenes the provisions of section 8 insofar as those provisions relate to the processing of an account number of a data subject is, subject to subsections (2) and (3), guilty of an offence.
  2. The contravention referred to in subsection (1) must—
    1. be of a serious or persistent nature; and
    2. likely cause substantial damage or distress to the data subject.
  3. The responsible party must—
    1. have known or ought to have known that—
      1. there was a risk that the contravention would occur; or
      2. such contravention would likely cause substantial damage or distress to the data subject; and
    2. have failed to take reasonable steps to prevent the contravention.
  4. Whenever a responsible party is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that he or she has taken all reasonable steps to comply with the provisions of section 8.
  5. ‘Account number’’, for purposes of this section and section 106, means any unique identifier that has been assigned—
    1. to one data subject only; or
    2. jointly to more than one data subject,
    3. by a financial or other institution which enables the data subject, referred to in paragraph (a), to access his, her or its own funds or to access credit facilities or which enables a data subject, referred to in paragraph (b), to access joint funds or to access joint credit facilities.

Section 106 Unlawful acts by third parties in connection with account number

  1. A person who knowingly or recklessly, without the consent of the responsible party—
    1. obtains or discloses an account number of a data subject; or
    2. procures the disclosure of an account number of a data subject to another person,
    3. is, subject to subsection (2), guilty of an offence.
  2. Whenever a person is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that—
    1. the obtaining, disclosure or procuring of the account number was—
      1. necessary for the purpose of the prevention, detection, investigation or proof of an offence; or
      2. required or authorised in terms of the law or in terms of a court order;
    2. he or she acted in the reasonable belief that he or she was legally entitled to obtain or disclose the account number or, as the case may be, to procure the disclosure of the account number to the other person;
    3. he or she acted in the reasonable belief that he or she would have had the consent of the responsible party if the responsible party had known of the obtaining, disclosing or procuring and the circumstances of it; or
    4. in the particular circumstances the obtaining, disclosing or procuring was in the public interest.
  3. A person who sells an account number which he or she has obtained in contravention of subsection (1), is guilty of an offence.
  4. A person who offers to sell the account number of a data subject which that person—
    1. has obtained; or
    2. subsequently obtained,
    3. in contravention of subsection (1), is guilty of an offence.
  5. For the purposes of subsection (4), an advertisement indicating that an account number of a data subject is or may be for sale is an offer to sell the information.

Section 107 Penalties

  1. Any person convicted of an offence in terms of this Act, is liable, in the case of a contravention of—
    1. section 100, 103(1), 104(2), 105(1), 106(1), (3) or (4) to a fine or to imprisonment for a period not exceeding 10 years, or to both a fine and such imprisonment; or
    2. section 59, 101, 102, 103(2) or 104(1), to a fine or to imprisonment for a period not exceeding 12 months, or to both a fine and such imprisonment.