Category: Risks of non-compliance

Section 109 Administrative fines

  1. If a responsible party is alleged to have committed an offence in terms of this Act, the Regulator may cause to be delivered by hand to that person (hereinafter referred to as the infringer) an infringement notice which must contain the particulars contemplated in subsection (2).
  2. A notice referred to in subsection (1) must—
    1. specify the name and address of the infringer;
    2. specify the particulars of the alleged offence;
    3. specify the amount of the administrative fine payable, which amount may, subject to subsection (10), not exceed R10 million;
    4. inform the infringer that, not later than 30 days after the date of service of the infringement notice, the infringer may—
      1. pay the administrative fine;
      2. make arrangements with the Regulator to pay the administrative fine in instalments; or
      3. elect to be tried in court on a charge of having committed the alleged offence referred to in terms of this Act; and
    5. state that a failure to comply with the requirements of the notice within the time permitted, will result in the administrative fine becoming recoverable as contemplated in subsection (5).
  3. When determining an appropriate fine, the Regulator must consider the following factors:
    1. the nature of the personal information involved;
    2. the duration and extent of the contravention;
    3. the number of data subjects affected or potentially affected by the contravention;
    4. whether or not the contravention raises an issue of public importance;
    5. the likelihood of substantial damage or distress, including injury to feelings or anxiety suffered by data subjects;
    6. whether the responsible party or a third party could have prevented the contravention from occurring;
    7. any failure to carry out a risk assessment or a failure to operate good policies, procedures and practices to protect personal information; and
    8. whether the responsible party has previously committed an offence in terms of this Act.
  4. If an infringer elects to be tried in court on a charge of having committed the alleged offence in terms of this Act, the Regulator must hand the matter over to the South African Police Service and inform the infringer accordingly.
  5. If an infringer fails to comply with the requirements of a notice, the Regulator may file with the clerk or registrar of any competent court a statement certified by it as correct, setting forth the amount of the administrative fine payable by the infringer, and such statement thereupon has all the effects of a civil judgment lawfully given in that court in favour of the Regulator for a liquid debt in the amount specified in the statement.
  6. The Regulator may not impose an administrative fine contemplated in this section if the responsible party concerned has been charged with an offence in terms of this Act in respect of the same set of facts.
  7. No prosecution may be instituted against a responsible party if the responsible party concerned has paid an administrative fine in terms of this section in respect of the same set of facts.
  8. An administrative fine imposed in terms of this section does not constitute a previous conviction as contemplated in Chapter 27 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977).
  9. A fine payable in terms of this section must be paid into the National Revenue Fund referred to in section 213 of the Constitution.
  10. The Minister may, from time to time and after consultation with the Regulator, by notice in the Gazette, adjust the amount referred to in subsection (2)(c) in accordance with the average of the consumer price index, as published from time to time in the Gazette, for the immediately preceding period of 12 months multiplied by the number of years that the amount referred to in subsection (2)(c) has remained the same.

Section 112 Regulations

  1. The Minister may, subject to section 113, make regulations relating to—
    1. the establishment of the Regulator; and
    2. fees referred to in section 111(1).
  2. The Regulator may, subject to section 113, make regulations relating to—
    1. the manner in terms of which a data subject may object to the processing of personal information as referred to in section 11(3);
    2. the manner in which a data subject may submit a request to a responsible party as referred to in section 24(1);
    3. the processing of health information by certain responsible parties as referred to in section 32(6);
    4. the responsibilities of information officers as referred to in section 55(1)(e);
    5. the form in terms of which an application for a code of conduct must be submitted to the Regulator as referred to in section 61(1)(b);
    6. the manner and form within which the data subject’s consent must be requested as referred to in section 69(2)
    7. the manner and form in terms of which a complaint must be submitted in terms of section 74;
    8. the Regulator acting as conciliator in relation to any interference with the protection of personal information as referred to in section 76(1)(b);
    9. the notification of the parties concerned of an investigation to be conducted as referred to in section 79;
    10. the settlement of complaints as referred to in section 80;
    11. the manner in which an assessment of the processing of personal information will be made as referred to in section 89(1);
    12. the manner in terms of which the parties concerned must be informed of the developments during and result of an investigation as referred to in section 94; and
    13. matters incidental to the imposition of administrative fines as referred to in section 109.