Nompumelelo Magwaza
Companies and government departments faced a long and difficult journey in ensuring they complied with the Protection of Personal Information Bill due to take effect next year, auditing firm PwC’s technology team said at the launch of its discussion paper on the bill yesterday.
The bill, which seeks to strengthen citizens’ constitutional right to privacy, will bring a significant level of protection to businesses and individuals as to how their personal information is handled. It will also hold organisations and companies accountable for their actions when dealing with such data.
The team said the bill was needed because of the current poor protection of personal information, which had led to rising levels of identity theft and associated fraud and intrusion on the privacy of individuals.
Another reason raised by PwC was the increase in the free flow of information over the internet and social media.
Once passed, the bill would give the data subject or individual owning that information the right to know what their information was being used for and the right to choose not to have their information processed.
An example on how this law would apply would be if individuals gave their cellphone numbers to a company for the purpose of receiving goods, then this should be the only time the firm could use that data.
“If the organisation then adds the number to a contact list for the purpose of sending the customer a text message to market goods to that individual, this process would be prohibited unless that individual gives the company permission to do so,” PwC said.
The discussion paper was based on the fifth draft of the bill released on October 26.
This final draft would have to make its way to the portfolio committee on justice and constitutional development by the end of the current parliamentary session. Once approved by the committee, the bill would go to the National Assembly for a vote early next year.
The anticipated timeline for this law has put enormous pressure on companies and all organisations that deal with personal information, according to PwC associate director Russell Opland.
“Other challenges for companies would be with complying with the requirements of the bill and this might have a significant impact on the way they do business.
“The key message for all organisations is that they need to start jumping on the bandwagon and sort out issues of compliance processes immediately,” he added.
The opinion throughout the survey has been that the bill is the most complex piece of privacy legislation in the world at the moment, and the burden of complying with it is going to be a difficult one, particularly for small to medium-sized businesses.
In addition to the time pressure faced by businesses and government departments, another notable challenge identified by the survey was the struggle to define the term “personal information”.
“The bill currently defines personal information as that relating to an identifiable person, including but not limited to the more than 45 data elements currently listed.”
The key, advised Opland, was “if you do not need the information for the purpose of concluding a transaction, then do not collect it. The less an organisation collects, the less information they will need to protect.”