ON JULY 1, South Africans will be expected to adhere to the watereddown version of the Protection of Personal Information Act (Popia).
The Information Regulator has extended the commencement date of the provision that requires organisations to obtain prior authorisation if they process certain categories of personal information.
The commencement date of that provision is now February 1 next year.
The section that has been extended is section 58(2), in relation to the section 57, which is Application for Prior Authorisation that now has a deadline of February 1 next year.
This means that an organisation that is required to obtain prior authorisation from the Information Regulator does not need to suspend its processing of personal information during such time that the Information Regulator is processing its application for prior authorisation.
Such organisations will not incur penalties under Popia for processing personal information after July 1 this year.
However, it is imperative that if an organisation does need prior authorisation, it must submit the application before February 1 next year.
South Africa is gradually moving towards fully protecting the data and information of its citizens online.
As part of the process and under Section 40(1) of Popia, the Information Regulator is empowered to monitor and enforce compliance.
The regulator’s enforcement powers will come into effect on July 1 this year.
The regulator has embarked on a recruitment process where it has recruited compliance and monitoring officers who will conduct monitoring of compliance with Popia and PAIA.
The regulator also has investigative powers in terms of Popia and PAIA,
which allows it to investigate complaints from the data subjects.
The regulator has indicated that it is appointing an enforcement committee which will have powers to issue notices against responsible parties in cases of non-compliance.
Non-compliance may result in administrative fines of up to R10 million, penalties and imprisonment.
What remains to be seen is the extent to which the monitoring will be effective.
BUSINESS REPORT